The United States has approximately 360 commercial sea and river ports that handle more than $1.3 trillion in cargo annually. A wide variety of goods, including automobiles, grain, and millions of cargo containers, travel through these ports each day. While no two ports are exactly alike, many share certain characteristics, like their size, general proximity to a metropolitan area, the volume of cargo being processed, and connections to complex transportation networks designed to move cargo and commerce as quickly as possible, that make them vulnerable to physical security threats. Entities within the maritime port environment are also vulnerable to cyber- based threats because maritime stakeholders rely on numerous types of information and communications technologies to manage the movement of cargo throughout ports. Examples of these technologies include the following: Terminal operating systems: These are information systems used by terminal operators to, among other things, control container movements and storage. For example, the terminal operating system is to support the logistical management of containers while in the terminal operator’s possession, including container movement and storage. To enhance the terminal operator’s operations, the system can also be integrated with other systems and technologies, such as financial systems, mobile computing, optical character recognition, and radio frequency identification systems. Industrial control systems: In maritime terminals, industrial control systems facilitate the movement of goods throughout the terminal using conveyor belts or pipelines to various structures (e.g., refineries, processing plants, and storage tanks). Business operations systems: These are information and communications technologies used to help support the business operations of the terminal, such as communicating with customers and preparing invoices and billing documentation. These systems can include e-mail and file servers, enterprise resource planning systems,networking equipment, phones, and fax machines. Access control and monitoring systems: Information and communication technology can also be used to support physical security operations at a port. For example, camera surveillance systems can be connected to information system networks to facilitate remote monitoring of port facilities, and electronically enabled physical access control devices can be used to protect sensitive areas of a port. See figure 1, an interactive graphic, for an overview of the technologies used in the maritime port environment. See appendix III for a printable version. Move mouse over blue system names to get descriptions of the systems. See appendix III for noninteractive version of this graphic. The location of the entity that manages these systems can also vary. Port facility officials we interviewed stated that some information technology systems used by their facilities are managed locally at the ports, while others are managed remotely from locations within and outside the United States. In addition, other types of automated infrastructure are used in the global maritime trade industry. For example, some ports in Europe use automated ground vehicles and stacking cranes to facilitate the movement of cargo throughout the ports. Like threats affecting other critical infrastructures, threats to the maritime information technology (IT) infrastructure can come from a wide array of sources. For example, advanced persistent threats—where adversaries possess sophisticated levels of expertise and significant resources to pursue their objectives—pose increasing risk. Threat sources include corrupt employees, criminal groups, hackers, and terrorists. These threat sources vary in terms of the capabilities of the actors, their willingness to act, and their motives, which can include monetary or political gain or mischief, among other things. Table 1 describes the sources of cyber- based threats in more detail. These sources of cyber threats may make use of various cyber techniques, or exploits, to adversely affect information and communications networks. Types of exploits include denial-of-service attacks, phishing, Trojan horses, viruses, worms, and attacks on the IT supply chains that support the communications networks. Table 2 describes the types of exploits in more detail. Similar to those in the United States, ports elsewhere in the world also rely on information and communications technology to facilitate their operations, and concerns about the potential impact of cybersecurity threats and vulnerabilities on these operations have been raised. For example, according to a 2011 report issued by the European Network and Information Security Agency, the maritime environment, like other sectors, increasingly relies on information and communications systems to optimize its operations, and the increased dependency on these systems, combined with the operational complexity and multiple stakeholders involved, make the environment vulnerable to cyber attacks. In addition, Australia’s Office of the Inspector of Transport Security reported in June 2012 that a cyber attack is probably the most serious threat to the integrity of offshore oil and gas facilities and land-based production. In addition, a recently reported incident highlights the risk that cybersecurity threats pose to the maritime port environment. Specifically, according to Europol’s European Cybercrime Center, a cyber incident was reported in 2013 (and corroborated by the Federal Bureau of Investigation) in which malware was installed on a computer at a foreign port. The reported goal of the attack was to track the movement of shipping containers for smuggling purposes. A criminal group used hackers to break into the terminal operating system to gain access to security and location information that was leveraged to remove the containers from the port. Port owners and operators are responsible for the cybersecurity of their operations, and federal plans and policies specify roles and responsibilities for federal agencies to support those efforts. In particular, the National Infrastructure Protection Plan (NIPP), a planning document originally developed pursuant to the Homeland Security Act of 2002 and Homeland Security Presidential Directive 7 (HSPD-7), sets forth a risk management framework to address the risks posed by cyber, human, and physical elements of critical infrastructure. It details the roles and responsibilities of DHS in protecting the nation’s critical infrastructures; identifies agencies that have lead responsibility for coordinating with the sectors (referred to as sector-specific agencies); and specifies how other federal, state, regional, local, tribal, territorial, and private-sector stakeholders should use risk management principles to prioritize protection activities within and across sectors. In addition, NIPP sets up a framework for operating and sharing information across and between federal and nonfederal stakeholders within each sector that includes the establishment of two types of councils: sector coordinating councils and government coordinating councils. The 2006 and 2009 NIPPs identified the U.S. Coast Guard as the sector-specific agency for the maritime mode of the transportation sector.and resilience strategies for the maritime environment. In this role, the Coast Guard is to coordinate protective programs Under NIPP, each critical infrastructure sector is also to develop a sector- specific plan to detail the application of its risk management framework for the sector. The 2010 Transportation Systems Sector-Specific Plan includes an annex for the maritime mode of transportation. The maritime annex is considered an implementation plan that details the individual characteristics of the maritime mode and how it will apply risk management, including a formal assessment of risk, to protect its systems, assets, people, and goods. In February 2013, the White House issued Presidential Policy Directive 21, which shifted the nation’s focus from protecting critical infrastructure against terrorism toward protecting and securing critical infrastructure and increasing its resilience against all hazards, including natural disasters, terrorism, and cyber incidents. The directive identified sector-specific agency roles and responsibilities to include, among other things, serving as a day-to-day federal interface for the prioritization and coordination of sector-specific activities. In December 2013, DHS released an updated version of NIPP. The 2013 NIPP reaffirms the role of various coordinating structures (such as sector coordinating councils and government coordinating councils) and integrates cyber and physical security and resilience efforts into an enterprise approach for risk management, among other things. The 2013 NIPP also reiterates the sector-specific agency roles and responsibilities as defined in Presidential Policy Directive 21. In addition, in February 2013 the President signed Executive Order 13636 for improving critical infrastructure cybersecurity. The executive order states that, among other things the National Institute of Standards and Technology shall lead the development of a cybersecurity framework that will provide technology-neutral guidance; the policy of the federal government is to increase the volume, timeliness, and quality of cyber threat information sharing with the U.S. private sector; agencies with responsibility to regulate the security of critical infrastructure shall consider prioritized actions to promote cyber security; and DHS shall identify critical infrastructure where a cybersecurity incident could have a catastrophic effect on public health or safety, economic security, or national security. The primary laws and regulations that establish DHS’s maritime security requirements include the Maritime Transportation Security Act of 2002 (MTSA), the Security and Accountability for Every Port Act of 2006 (SAFE Port Act),laws. and Coast Guard’s implementing regulations for these Enacted in November 2002, MTSA requires a wide range of security improvements for protecting our nation’s ports, waterways, and coastal areas. DHS is the lead agency for implementing the act’s provisions and relies on its component agencies, including the Coast Guard and FEMA, to help implement the act. The Coast Guard is responsible for security of U.S. maritime interests, including completion of security plans related to geographic areas around ports with input from port stakeholders. These plans are to assist the Coast Guard in the protection against transportation security incidents across the maritime port environment. The Coast Guard has designated a captain of the port within each of 43 geographically defined port areas across the nation who is responsible for overseeing the development of the security plans within his or her respective geographic region. The MTSA implementing regulations, developed by the Coast Guard, require the establishment of area maritime security committees across all port areas. The committees for each of the 43 identified port areas, which are organized by the Coast Guard, consist of key stakeholders who (1) may be affected by security policies and (2) share information and develop port security plans. Members of the committees can include a diverse array of port stakeholders, including federal, state, local, tribal, and territorial law enforcement agencies, as well as private sector entities such as terminal operators, yacht clubs, shipyards, marine exchanges, commercial fishermen, trucking and railroad companies, organized labor, and trade associations. These committees are to identify critical port infrastructure and risks to the port, develop mitigation strategies for these risks, and communicate appropriate security information to port stakeholders. The area maritime security committees, in consultation with applicable stakeholders within their geographic region, are to assist the Coast Guard in developing the port area maritime security plans. Each area maritime security plan is to describe the area and infrastructure covered by the plan, establish area response and recovery protocols for a transportation security incident, and include any other information DHS requires. In addition, during the development of each plan, the Coast Guard is to develop a risk-based security assessment that includes the identification of the critical infrastructure and operations in the port, a threat assessment, and a vulnerability and consequence assessment, among other things. The assessment is also to consider, among other things, physical security of infrastructure and operations of the port, existing security systems available to protect maritime personnel, and radio and telecommunication systems, including computer systems and networks as well as other areas that may, if damaged, pose a risk to people, infrastructure, or operations within the port. Upon completion of the assessment, a written report must be prepared that documents the assessment methodology that was employed, describes each vulnerability identified and the resulting consequences, and provides risk reduction strategies that could be used for continued operations in the port. MTSA and its associated regulations also require port facility owners and operators to develop facility security plans for the purpose of preparing certain maritime facilities, such as container terminals and chemical processing plants, to deter a transportation security incident. The plans are to be updated at least every 5 years and are expected to be consistent with the port’s area maritime security plan. The MTSA implementing regulations require that the facility security plans document information on security systems and communications, as well as facility vulnerability and security measures, among other things. The implementing regulations also require port facility owners and operators, as well as their designated facility security officers, to ensure that a facility security assessment is conducted and that, upon completion, a written report is included with the corresponding facility security plan submission for review and approval by the captain of the port. The facility security assessment report must include an analysis that considers measures to protect radio and telecommunications equipment, including computer systems and networks, among other things. Enacted in October 2006, the SAFE Port Act created and codified new programs and initiatives related to the security of the U.S. ports, and amended some of the original provisions of MTSA. For example, the SAFE Port Act required the Coast Guard to establish a port security exercise program. MTSA also codified the Port Security Grant Program, which is to help defray the costs of implementing security measures at domestic ports. According to MTSA, funding is to be directed towards the implementation of area maritime security plans and facility security plans among port authorities, facility operators, and state and local government agencies that are required to provide port security services. Port areas use funding from the grant program to improve port-wide risk management, enhance maritime domain awareness, and improve port recovery and resiliency efforts through developing security plans, purchasing security equipment, and providing security training to employees. FEMA is responsible for designing and operating the administrative mechanisms needed to implement and manage the grant program. Coast Guard officials provide subject matter expertise regarding the maritime industry to FEMA to inform grant award decisions. DHS and the other stakeholders have taken limited steps with respect to maritime cybersecurity. In particular, the Coast Guard did not address cybersecurity threats in a 2012 national-level risk assessment. In addition, area maritime security plans and facility security plans provide limited coverage of cybersecurity considerations. While the Coast Guard helped to establish mechanisms for sharing security-related information, the degree to which these mechanisms were active and facilitated the sharing of cybersecurity-related information varied. Also, FEMA had taken steps to address cybersecurity through the Port Security Grant Program, but it has not taken additional steps to help ensure cyber-related risks are effectively addressed. Other federal stakeholders have also taken some actions to address cybersecurity in the maritime environment. According to DHS officials, a primary reason for limited efforts in addressing cyber- related threats in the maritime environment is that the severity of cyber- related threats has only recently been recognized. Until the Coast Guard and FEMA take additional steps to more fully implement their efforts, the maritime port environment remains at risk of not adequately considering cyber-based threats in its mitigation efforts. While the Coast Guard has assessed risks associated with physical threats to port environments, these assessments have not considered risks related to cyber threats. NIPP recommends sector-specific agencies and critical infrastructure partners manage risks from significant threats and hazards to physical and cyber critical infrastructure for their respective sectors through, among other things, the identification and detection of threats and hazards to the nation’s critical infrastructure; reduction of vulnerabilities of critical assets, systems, and networks; and mitigation of potential consequences to critical infrastructure if incidents occur. The Coast Guard completes, on a biennial basis, the National Maritime Strategic Risk Assessment, which is to be an assessment of risk within the maritime environment and risk reduction based on the agency’s efforts. Its results are to provide a picture of the risk environment, including a description of the types of threats the Coast Guard is expected to encounter within its areas of responsibility, such as ensuring the security of port facilities, over the next 5 to 8 years. The risk assessment is also to be informed by numerous inputs, such as historical incident and performance data, the views of subject matter experts, and risk models, including the Maritime Security Risk Analysis Model. However, the Coast Guard did not address cybersecurity in the fourth and latest iteration of the National Maritime Strategic Risk Assessment, which was issued in 2012. While the assessment contained information regarding threats, vulnerabilities, and the mitigation of potential risks in the maritime environment, none of the information addressed cyber- related risks. The Coast Guard attributed this gap to its limited efforts to develop inputs related to cyber threats, vulnerabilities, and consequences to inform the assessment. Additionally, Coast Guard officials stated that the Maritime Security Risk Analysis Model, a key input to the risk assessment, did not contain information regarding cyber-related threats, vulnerabilities, and potential impacts of cyber incidents. The Coast Guard plans to address this deficiency in the next iteration of the assessment, which is expected to be completed by September 2014, but officials could provide no details on how cybersecurity would be specifically addressed. Without a thorough assessment of cyber-related threats, vulnerabilities, and potential consequences to the maritime subsector, the Coast Guard has limited assurance that the maritime mode is adequately protected against cyber-based threats. Assessments of cyber risk would help the Coast Guard and other maritime stakeholders understand the most likely and severe types of cyber-related incidents that could affect their operations and use this information to support planning and resource allocation to mitigate the risk in a coordinated manner. Until the Coast Guard completes a thorough assessment of cyber risks in the maritime environment, maritime stakeholders will be less able to appropriately plan and allocate resources to protect the maritime transportation mode. MTSA and the SAFE Port Act provide the statutory framework for preventing, protecting against, responding to, and recovering from a transportation security incident in the maritime environment. MTSA requires maritime stakeholders to develop security documentation, including area maritime security plans and facility security plans. These plans, however, do not fully address the cybersecurity of their respective ports and facilities. Area maritime security plans do not fully address cyber-related threats, vulnerabilities, and other considerations. The three area maritime security plans we reviewed from the three high-risk port areas we visited generally contained very limited, if any, information about cyber-related threats and mitigation activities. For example, the three plans reviewed included information about the types of information and communications technology systems that would be used to communicate security information to prevent, manage, and respond to a transportation security incident; the types of information that are considered to be Sensitive Security Information; and how to securely handle and transmit this information to those with a need to know. However, the MTSA-required plans did not identify or address any other potential cyber-related threats directed at or vulnerabilities in the information and communications systems or include cybersecurity measures that port area stakeholders should take to prevent, manage, and respond to cyber-related threats and vulnerabilities. Coast Guard officials we met with agreed that the current set of area maritime security plans, developed in 2009, do not include cybersecurity information. This occurred in part because, as Coast Guard officials stated, the guidance for developing area maritime security plans did not require the inclusion of a cyber component. As a result, port area stakeholders may not be adequately prepared to successfully manage the risk of cyber-related transportation security incidents. Coast Guard officials responsible for developing area maritime security plan guidance stated that the implementing policy and guidance for developing the next set of area maritime security plans includes basic considerations that maritime stakeholders should take into account to address cybersecurity. Currently, the area maritime security plans are formally reviewed and approved on a 5-year cycle, so the next updates will occur in 2014 and will be based on recently issued policy and guidance. Coast Guard officials stated that the policy and guidance for developing the area security plans was updated and promulgated in July 2013 and addressed inclusion of basic cyber components. Examples include guidance to identify how the Coast Guard will communicate with port stakeholders in a cyber-degraded environment, the process for reporting a cyber-related breach of security, and direction to take cyber into account when developing a port’s “all hazard”-compatible Marine Transportation System Recovery Plan. Our review of the guidance confirmed that it instructs preparers to generally consider cybersecurity issues related to information and communication technology systems when developing the plans. However, the guidance does not include any information related to the mitigation of cyber threats. Officials representing both the Coast Guard and nonfederal entities that we met with stated that the current facility security plans also do not contain cybersecurity information. Our review of nine facility security plans from the organizations we met with during site visits confirmed that those plans generally have very limited cybersecurity information. For example, two of the plans had generic references to potential cyber threats, but did not have any specific information on assets that were potentially vulnerable or associated mitigation strategies. According to federal and nonfederal entities, this is because, similar to the guidance for the area security plans, the current guidelines for facility security plans do not explicitly require entities to include cybersecurity information in the plans. Coast Guard officials stated that the next round of facility security plans, to be developed in 2014, will include cybersecurity provisions. Since the plans are currently in development, we were unable to determine the degree to which cybersecurity information will be included. Without the benefit of a national-level cyber-related risk assessment of the maritime infrastructure to inform the development of the plans, the Coast Guard has limited assurance that maritime-related security plans will appropriately address cyber-related threats and vulnerabilities associated with transportation security incidents. Although the Coast Guard helped to establish mechanisms for sharing security-related information, the degree to which these mechanisms were active and shared cybersecurity-related information varied. As the DHS agency responsible for maritime critical infrastructure protection-related efforts, the Coast Guard is responsible for establishing public-private partnerships and sharing information with federal and nonfederal entities in the maritime community. This information sharing is to occur through formalized mechanisms called for in federal plans and policy. Specifically, federal policy establishes a framework that includes government coordinating councils—composed of federal, state, local, or tribal agencies—and encourages the voluntary formation of sector coordinating councils, typically organized, governed by, and made up of nonfederal stakeholders. Further, federal policy also encourages sector-specific agencies to promote the formulation of information sharing and analysis centers (ISAC), which are to serve as voluntary mechanisms formed by owners and operators for gathering, analyzing, and disseminating information on infrastructure threats and vulnerabilities among owners and operators of the sectors and the federal government. The Maritime Modal Government Coordinating Council was established in 2006 to enable interagency coordination on maritime security issues. Coast Guard officials stated that the primary membership consisted of representatives from the Departments of Homeland Security, Transportation, Commerce, Defense, and Justice. Coast Guard officials stated that the council has met since 2006, but had only recently begun to discuss cybersecurity issues. For example, at its January 2013 annual meeting, the council discussed the implications of Executive Order 13636 for improving critical infrastructure cybersecurity for the maritime mode. In addition, during the January 2014 meeting, Coast Guard officials discussed efforts related to the development of a risk management framework that integrates cyber and physical security resilience efforts. In 2007, the Maritime Modal Sector Coordinating Council, consisting of owners, operators, and associations from within the sector, was established to enable coordination and information sharing within the sector and with government stakeholders. However, the council disbanded in March 2011 and is no longer active. Coast Guard officials attributed the demise of the council to a 2010 presidential memorandum that precluded the participation of registered lobbyists in advisory committees and other boards and commissions, which includes all Critical Infrastructure Partnership Advisory Council bodies, including the Critical Infrastructure Cross-Sector Council, and all sector coordinating councils, according to DHS. The former chair of the council stated that a majority of the members were registered lobbyists, and, as small trade associations, did not have non-lobbyist staff who could serve in this role. The Coast Guard has attempted to reestablish the sector coordinating council, but has faced challenges in doing so. According to Coast Guard officials, maritime stakeholders that would likely participate in such a council had viewed it as duplicative of statutorily authorized mechanisms, such as the National Maritime Security Advisory Committee and area maritime security committees. As a result, Coast Guard officials stated that there has been little stakeholder interest in reconstituting the council. While Coast Guard officials stated that these committees, in essence, meet the information-sharing requirements of NIPP and, to some extent, may expand the NIPP construct into real world “all hazards” response and recovery activities, these officials also stated that the committees do not fulfill all the functions of a sector coordinating council. For example, a key function of the council is to provide national-level information sharing and coordination of security-related activities within the sector. In contrast, the activities of the area maritime security committees are generally focused on individual port areas. In addition, while the National Maritime Security Advisory Committee is made up of maritime-related private-sector stakeholders, its primary purpose is to advise and make recommendations to the Secretary of Homeland Security so that the government can take actions related to securing the maritime port environment. Similarly, another primary function of the sector coordinating council may include identifying, developing, and sharing information concerning effective cybersecurity practices, such as cybersecurity working groups, risk assessments, strategies, and plans. Although Coast Guard officials stated that several of the area maritime security committees had addressed cybersecurity in some manner, the committees do not provide a national-level perspective on cybersecurity in the maritime mode. Coast Guard officials could not demonstrate that these committees had a national-level focus to improve the maritime port environment’s cybersecurity posture. In addition, the Maritime Information Sharing and Analysis Center was to serve as the focal point for gathering and disseminating information regarding maritime threats to interested stakeholders; however, Coast Guard officials could not provide evidence that the body was active or identify the types of cybersecurity information that was shared through it. They stated that they fulfill the role of the ISAC through the use of Homeport—a publicly accessible and secure Internet portal that supports port security functionality for operational use. According to the officials, Homeport serves as the Coast Guard’s primary communications tool to support the sharing, collection, and dissemination of information of various classification levels to maritime stakeholders. However, the Coast Guard could not show the extent to which cyber-related information was shared through the portal. Though the Coast Guard has established various mechanisms to coordinate and share information among government entities at a national level and between government and private stakeholders at the local level, it has not facilitated the establishment of a national-level council, as recommended by NIPP. The absence of a national-level sector coordinating council increases the risk that critical infrastructure owners and operators would not have a mechanism through which they can identify, develop, and share information concerning effective cybersecurity practices, such as cybersecurity working groups, risk assessments, strategies, and plans. As a result, the Coast Guard would not be aware of and thus not be able to mitigate cyber-based threats. Under the Port Security Grant Program, FEMA has taken steps to address cybersecurity in port areas by identifying enhancing cybersecurity capabilities as a funding priority in fiscal years 2013 and 2014 and by providing general guidance regarding the types of cybersecurity-related proposals eligible for funding. DHS annually produces guidance that provides the funding amounts available under the program for port areas and information about eligible applicants, the application process, and funding priorities for that fiscal year, among other things. Fiscal year 2013 and 2014 guidance stated that DHS identified enhancing cybersecurity capabilities as one of the six priorities for selection criteria for all grant proposals in these funding cycles. FEMA program managers stated that FEMA added projects that aim to enhance cybersecurity capabilities as a funding priority in response to the issuance of Presidential Policy Directive 21 in February 2013. Specifically, the 2013 guidance stated that grant funds may be used to invest in functions that support and enhance port-critical infrastructure and key resources in both physical space and cyberspace under Presidential Policy Directive 21. The 2014 guidance expanded on this guidance to encourage applicants to propose projects to aid in the implementation of the National Institute of Standards and Technology’s cybersecurity framework, established pursuant to Executive Order 13636, and provides a hyperlink to additional information about the framework. In addition, the guidance refers applicants to the just-established DHS Critical Infrastructure Cyber Community Voluntary Program for resources to assist critical infrastructure owners and operators in the adoption of the framework and managing cyber risks. While these actions are positive steps towards addressing cybersecurity in the port environment, FEMA has not consulted individuals with cybersecurity-related subject matter expertise to assist with the review of cybersecurity-related proposals. Program guidance states that grant applications are to undergo a multi-level review for final selection, including a review by a National Review Panel, comprised of subject matter experts drawn from the Departments of Homeland Security and Transportation. However, according to FEMA program managers, the fiscal year 2013 National Review Panel did not include subject matter experts from DHS cybersecurity and critical infrastructure agencies—such as the DHS Office of Cybersecurity and Communications, the DHS Office of Infrastructure Protection, or the Coast Guard’s Cyber Command. As a result, the National Review Panel had limited subject matter expertise to evaluate and prioritize cybersecurity-related grant proposals for funding. Specifically, according to FEMA guidance, the proposal review and selection process consists of three levels: an initial review, a field review, and a national-level review. During the initial review, FEMA officials review grant proposals for completion. During the field review, Coast Guard captains of the port, in coordination with officials of the Department of Transportation’s Maritime Administration, review and score proposals according to (1) the degree to which a proposal addresses program goals, including enhancing cybersecurity capabilities, and (2) the degree to which a proposal addresses one of the area maritime security plan priorities (e.g., transportation security incident scenarios), among other factors. The captains of the port provide a prioritized list of eligible projects for funding within each port area to FEMA, which coordinates the national review process. In March 2014, FEMA program managers stated that cybersecurity experts were not involved in the National Review Panel in part because the panel has been downsized in recent years. For the future, the officials stated that FEMA is considering revising the review process to identify cybersecurity proposals early on in the review process in order to obtain relevant experience and expertise from the Coast Guard and other subject matter experts to inform proposal reviews. However, FEMA has not documented this new process or its procedures for the Coast Guard and FEMA officials at the field and national review levels to follow for the fiscal year 2014 and future cycles. In addition, because the Coast Guard has not conducted a comprehensive risk assessment for the maritime environment that includes cyber-related threats, grant applicants and DHS officials have not been able to use the results of such an assessment to inform their grant proposals, project scoring, and risk-based funding decisions. MTSA states that, in administering the program, national economic and strategic defense concerns based on the most current risk assessments available shall be taken into account. Further, according to MTSA, Port Security Grant Program funding is to be used to address Coast Guard-identified vulnerabilities, among other purposes. FEMA officials stated that the agency considers port risk during the allocation and proposal review stages of the program funding cycle. However, FEMA program managers stated that the risk formula and risk-based analysis that FEMA uses in the allocation and proposal review stages do not assess cyber threats and vulnerabilities. Additionally, during the field-level review, captains of the port score grant proposals according to (1) the degree to which a proposal addresses program goals, including enhancing cybersecurity capabilities, and (2) the degree to which a proposal addresses one of the area maritime security plan priorities (e.g., transportation security incident scenarios), among other factors. However, as Coast Guard officials stated, and our review of area maritime security plans indicated, current area maritime security plans generally contain very limited, if any, information about cyber- related threats. Further, a FEMA Port Security Grant Program section chief stated that he was not aware of a risk assessment for the maritime mode that discusses cyber-related threats, vulnerabilities, and potential impact. Using the results of such a maritime risk assessment that fully addresses cyber-related threats, vulnerabilities, and consequences, which—as discussed previously—has not been conducted, to inform program guidance could help grant applicants and reviewers more effectively identify and select projects for funding that could enhance the cybersecurity of the nation’s maritime cyber infrastructure. Furthermore, FEMA has not developed or implemented outcome measures to evaluate the effectiveness of the Port Security Grant Program in achieving program goals, including enhancing cybersecurity capabilities. As we reported in November 2011, FEMA had not evaluated the effectiveness of the Port Security Grant Program in strengthening critical maritime infrastructure because it had not implemented measures to track progress toward achieving program goals. Therefore, we recommended that FEMA—in collaboration with the Coast Guard— develop time frames and related milestones for implementing performance measures to monitor the effectiveness of the program. In response, in February 2014 FEMA program managers stated that the agency developed and implemented four management and administrative measures in 2012 and two performance measures to track the amount of funds invested in building and sustaining capabilities in 2013. According to a FEMA program manager, FEMA did not design the two performance measures to evaluate the effectiveness of the program in addressing individual program goals, such as enhancing cybersecurity capabilities, but to gauge the program’s effectiveness in reducing overall maritime risk in a port area based on program funding. While these measures can help improve FEMA’s management of the program by tracking how funds are invested, they do not measure program outcomes. In addition, in February 2012, we found that FEMA had efforts under way to develop outcome measures for the four national preparedness grant programs, including the Port Security Grant Program, but that it had not completed these efforts. Therefore, we recommended that FEMA revise its plan in order to guide the timely completion of ongoing efforts to develop and implement outcome-based performance measures for all four grant programs. In January 2014, FEMA officials stated that they believe that the implementation of project-based grant application tracking and reporting functions within the Non-Disaster Grant Management System will address our February 2012 recommendation that the agency develop outcome measures to determine the effectiveness of the Port Security Grant Program. However, the officials did not provide details about how these functions will address the recommendation. While the development of the Non-Disaster Grant Management System is a positive step toward improving the management and administration of preparedness grants, FEMA officials stated that the deployment of these system functions has been delayed due to budget reductions, and the time frame for building the project-based applications and reporting functions is fiscal year 2016. Therefore, it is too early to determine how FEMA will use the system to evaluate the effectiveness of the Port Security Grant Program. Until FEMA develops outcome measures to evaluate the effectiveness of the program in meeting program goals, it cannot provide reasonable assurance that funds invested in port security grants, including those intended to enhance cybersecurity capabilities, are strengthening critical maritime infrastructure—including cyber-based infrastructure—against risks associated with potential terrorist attacks and other incidents. In addition to DHS, the 2010 Transportation Systems Sector-Specific Plan identified the Departments of Commerce, Defense, Justice, and Transportation as members of the Maritime Modal Government Coordinating Council. Many agencies, including others within DHS, had taken some actions with respect to the cybersecurity of the maritime subsector. For more details on these actions, see appendix II. Disruptions in the operations of our nation’s ports, which facilitate the import and export of over $1.3 trillion worth of goods annually, could be devastating to the national economy. While the impact of a physical event (natural or manmade) appears to have been better understood and addressed by maritime stakeholders than cyber-based events, the growing reliance on information and communications technology suggests the need for greater attention to potential cyber-based threats. Within the roles prescribed for them by federal law, plans, and policy, the Coast Guard and FEMA have begun to take action. In particular, the Coast Guard has taken action to address cyber-based threats in its guidance for required area and facility plans and has started to leverage existing information-sharing mechanisms. However, until a comprehensive risk assessment that includes cyber-based threats, vulnerabilities, and consequences of an incident is completed and used to inform the development of guidance and plans, the maritime port sector remains at risk of not adequately considering cyber-based risks in its mitigation efforts. In addition, the maritime sector coordinating council is currently defunct, which may limit efforts to share important information on threats affecting ports and facilities on a national level. Further, FEMA has taken actions to enhance cybersecurity through the Port Security Grant Program by making projects aimed at enhancing cybersecurity one of its funding priorities. However, until it develops procedures to instruct grant reviewers to consult cybersecurity-related subject matter experts and uses the results of a risk assessment that identifies any cyber-related threats and vulnerabilities to inform its funding guidance, FEMA will be limited in its ability to ensure that the program is effectively addressing cyber-related risks in the maritime environment. To enhance the cybersecurity of critical infrastructure in the maritime sector, we recommend that the Secretary of Homeland Security direct the Commandant of the Coast Guard to take the following actions: work with federal and nonfederal partners to ensure that the maritime risk assessment includes cyber-related threats, vulnerabilities, and potential consequences; use the results of the risk assessment to inform how guidance for area maritime security plans, facility security plans, and other security- related planning should address cyber-related risk for the maritime sector; and work with federal and nonfederal stakeholders to determine if the Maritime Modal Sector Coordinating Council should be reestablished to better facilitate stakeholder coordination and information sharing across the maritime environment at the national level. To help ensure the effective use of Port Security Grant Program funds to support the program’s stated mission of addressing vulnerabilities in the maritime port environment, we recommend that the Secretary of Homeland Security direct the FEMA Administrator to take the following actions: in coordination with the Coast Guard, develop procedures for officials at the field review level (i.e., captains of the port) and national review level (i.e., the National Review Panel and FEMA) to consult cybersecurity subject matter experts from the Coast Guard and other relevant DHS components, if applicable, during the review of cybersecurity grant proposals for funding and in coordination with the Coast Guard, use any information on cyber- related threats, vulnerabilities, and consequences identified in the maritime risk assessment to inform future versions of funding guidance for grant applicants and reviews at the field and national levels. We provided a draft of this report to the Departments of Homeland Security, Commerce, Defense, Justice, and Transportation for their review and comment. DHS provided written comments on our report (reprinted in app. IV). In its comments, DHS concurred with our recommendations. In addition, the department stated that the Coast Guard is working with a variety of partners to determine how cyber- related threats, vulnerabilities, and potential consequences are to be addressed in the maritime risk assessment, which the Coast Guard will use to inform security planning efforts (including area maritime security plans and facility security plans). DHS also stated that the Coast Guard will continue to promote the re-establishment of a sector coordinating council, and will also continue to use existing information-sharing mechanisms. However, DHS did not provide an estimated completion date for these efforts. In addition, DHS stated that FEMA will work with the Coast Guard to develop the recommended cyber consultation procedures for the Port Security Grant Program by the end of October 2014, and will use any information on cyber-related threats, vulnerabilities, and consequences from the maritime risk assessment in future program guidance, which is scheduled for publication in the first half of fiscal year 2015. Officials from DHS and the Department of Commerce also provided technical comments via e-mail. We incorporated these comments where appropriate. Officials from the Departments of Defense, Justice, and Transportation stated that they had no comments. We are sending copies of this report to interested congressional committees; the Secretaries of Commerce, Defense, Homeland Security, and Transportation; the Attorney General of the United States; the Director of Office of Management and Budget; and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov or Stephen L. Caldwell at (202) 512-9610 or caldwells@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V. Our objective was to identify the extent to which the Department of Homeland Security (DHS) and other stakeholders have taken steps to address cybersecurity in the maritime port environment. The scope of our audit focused on federal agencies that have a role or responsibilities in the security of the maritime port environment, to include port facilities. We focused on the information and communications technology used to operate port facilities. We did not include other aspects of the maritime environment such as vessels, off-shore platforms, inland waterways, intermodal connections, systems used to manage water-based portions of the port, and federally managed information and communication technology. To identify federal agency roles and select the organizations responsible for addressing cybersecurity in the maritime port environment, we reviewed relevant federal law, regulations, policy, and critical infrastructure protection-related strategies, including the following: Homeland Security Act of 2002; Maritime Transportation Security Act of 2002; Homeland Security Presidential Directive 7—Critical Infrastructure Identification, Prioritization, and Protection, December 2003; Security and Accountability for Every Port Act of 2006; 2006 National Infrastructure Protection Plan; 2009 National Infrastructure Protection Plan; 2013 National Infrastructure Protection Plan; 2010 Transportation Systems Sector-Specific Plan; Presidential Policy Directive 21—Critical Infrastructure Security and Resilience, February 12, 2013; Executive Order 13636—Improving Critical Infrastructure Title 33, Code of Federal Regulations, Chapter 1, Subchapter H. We analyzed these documents to identify federal agencies responsible for taking steps to address cybersecurity in the maritime environment, such as developing a risk assessment and information-sharing mechanisms, guiding the development of security plans in response to legal requirements, and providing financial assistance to support maritime port security activities. Based on our analysis, we determined that the U.S. Coast Guard (Coast Guard) and Federal Emergency Management Agency (FEMA), within DHS, were relevant to our objective. We also included the Departments of Transportation, Defense, Commerce, and Justice as they were identified as members of the Maritime Modal Government Coordinating Council in the 2010 Transportation Systems Sector-Specific Plan. We also included other DHS components, such as U.S. Customs and Border Protection, National Protection and Programs Directorate, Transportation Security Administration, and United States Secret Service, based on our prior cybersecurity and port security work and information learned from interviews during our engagement. To determine the extent to which the Coast Guard and FEMA have taken steps to address cybersecurity in the maritime port environment, we collected and analyzed relevant guidance and reports. For example, we analyzed the Coast Guard’s 2012 National Maritime Strategic Risk Assessment, Coast Guard guidance for developing area maritime security plans, the 2012 Annual Progress Report—National Strategy for Transportation Security, the Transportation Sector Security Risk Assessment, and FEMA guidance for applying for and reviewing proposals under the Port Security Grant Program. We also examined our November 2011 and February 2012 reports related to the Port Security Grant Program and our past work related to FEMA grants management for previously identified issues and context. In addition, we gathered and analyzed documents and interviewed officials from DHS’s Coast Guard, FEMA, U.S. Customs and Border Protection, Office of Cybersecurity and Communications, Office of Infrastructure Protection, Transportation Security Administration, and United States Secret Service; the Department of Commerce’s National Oceanic and Atmospheric Administration; the Department of Defense’s Transportation Command; the Department of Justice’s Federal Bureau of Investigation; and the Department of Transportation’s Maritime Administration, Office of Intelligence, Security and Emergency Response, and the Volpe Center. To gain an understanding of how information and communication technology is used in the maritime port environment and to better understand federal interactions with nonfederal entities on cybersecurity issues, we conducted site visits to three port areas—Houston, Texas; Los Angeles/Long Beach, California; and New Orleans, Louisiana. These ports were selected in a non-generalizable manner based on their identification as both high risk (Group I) ports by the Port Security Grant Program, and as national leaders in calls by specific types of vessels— oil and natural gas, containers, and dry bulk—in the Department of Transportation Maritime Administration’s March 2013 report, Vessel Calls Snapshot, 2011. For those port areas, we analyzed the appropriate area maritime security plans for any cybersecurity-related information. We also randomly selected facility owners from Coast Guard data on those facilities required to prepare facility security plans under the Maritime Transportation Security Act’s implementing regulations. For those facilities whose officials agreed to participate in our review, we interviewed staff familiar with Coast Guard facility security requirements or information technology security, and analyzed their facility security plans for any cybersecurity-related items. We also included additional nonfederal entities such as port authorities and facilities as part of our review. The results of our analysis of area maritime security plans and facility security plans at the selected ports cannot be projected to other facilities at the port areas we visited or other port areas in the country. We also met with other port stakeholders, such as port authorities and an oil storage and transportation facility. We met with the following organizations: APM Terminals Axiall Cargill Domino Sugar Company Harris County, Texas, Information Technology Center Louisiana Offshore Oil Port Magellan Terminals Holdings, L.P. Metropolitan Stevedoring Port of Houston Authority Port of Long Beach Port of Los Angeles Port of New Orleans SSA Marine St. Bernard Port Trans Pacific Container Service We determined that information provided by the federal and nonfederal entities, such as the type of information contained within the area maritime security plans and facility security plans, was sufficiently reliable for the purposes of our review. To arrive at this assessment, we corroborated the information by comparing the plans with statements from relevant agency officials. We conducted this performance audit from April 2013 to June 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. This appendix summarizes cybersecurity-related actions, if any, taken by other agencies of the departments identified as members of the Government Coordinating Council of the Maritime Mode related to the nonfederally owned and operated maritime port environment. Under Executive Order 13636, the Secretary of Homeland Security is to use a risk-based approach to identify critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security. The Secretary is also to apply consistent, objective criteria in identifying such critical infrastructure. Sector-specific agencies were to provide the Secretary with information necessary to identify such critical infrastructure. To implement Executive Order 13636, DHS established an Integrated Task Force to, among other things, lead DHS implementation and coordinate interagency and public- and private-sector efforts. One of the eight working groups that made up the task force was assigned the responsibility for identifying cyber-dependent infrastructure. Officials from DHS’s Office of Infrastructure Protection who were responsible for the working group stated that, using the defined methodology, the task force examined the maritime mode as part of its efforts. Office of Cybersecurity and Communications The Office of Cybersecurity and Communications, among other things, is responsible for collaborating with public, private, and international partners to ensure the security and continuity of the nation’s cyber and communications infrastructures in the event of terrorist attacks, natural disasters, and catastrophic incidents. One division of the Office of Cybersecurity and Communications (Stakeholder Engagement and Cyber Infrastructure Resilience) offers to partner with critical infrastructure partners—including those in the maritime port environment—to conduct cyber resilience reviews. These reviews are voluntary and are based on the CERT® Resilience Management Model, a process improvement model for managing operational resilience. They are facilitated by field-based Cyber Security Advisors. The primary goal of this program is to evaluate how critical infrastructure and key resource providers manage the cybersecurity of significant information. In addition, the Industrial Control Systems Cyber Emergency Response Team——a branch of the National Cybersecurity and Communications Integration Center division within the Office of Cybersecurity and Communications—directed the development of the Cyber Security Evaluation Tool, which is a self-assessment tool that evaluates the cybersecurity of an automated industrial control or business system using a hybrid risk- and standards-based approach, and provides relevant recommendations for improvement. We observed one maritime port entity engage with Office of Cybersecurity and Communications staff members to conduct a cyber resilience review. According to data provided by Office of Cybersecurity and Communications officials, additional reviews have been conducted with maritime port entities. In addition, three maritime port entities informed us they conducted a self-assessment using the Cyber Security Evaluation Tool. The Office of Infrastructure Protection is responsible for working with public- and private-sector critical infrastructure partners and leads the coordinated national effort to mitigate risk to the nation’s critical infrastructure. Among other things, the Office of Infrastructure Protection has the overall responsibility for coordinating implementation of NIPP across 16 critical infrastructure sectors and overseeing the development of 16 sector-specific plans. Through its Protective Security Coordination Division, the Office of Infrastructure Protection also has a network of field-based protective security advisors, who are security experts that serve as a direct link between the department and critical infrastructure partners in the field. Two nonfederal port stakeholders identified protective security advisors as a resource for assistance in cybersecurity issues. Officials from Infrastructure Protection’s Strategy and Policy Office supported the Coast Guard in developing the sector-specific plan and annual report for the maritime mode. U.S. Customs and Border Protection (CBP) is responsible for securing America’s borders. This includes ensuring that all cargo enters the United States legally, safely, and efficiently through official sea ports of entry; preventing the illegal entry of contraband into the country at and between ports of entry; and enforcing trade, tariff, and intellectual property laws and regulations. In addition, CBP developed and administered the Customs-Trade Partnership Against Terrorism program, a voluntary program where officials work in partnership with private companies to review the security of their international supply chains and improve the security of their shipments to the United States. Under this program, CBP issued minimum security criteria for U.S.-based marine port authority and terminal operators that include information technology security practices (specifically, password protection, establishment of information technology security policies, employee training on information technology security, and developing a system to identify information technology abuse that includes improper access). Among other things, the Secret Service protects the President, Vice President, visiting heads of state and government, and National Special Security Events; safeguards U.S. payment and financial systems; and investigates cyber/electronic crimes. In support of these missions, the Secret Service has several programs that have touched on maritime port cybersecurity. The Electronic Crimes Task Force initiative is a network of task forces established in the USA PATRIOT Act for the purpose of preventing, detecting, and investigating various forms of electronic crimes, including potential terrorist attacks against critical infrastructure and financial payments systems. The Secret Service also conducts Critical Systems Protection advances for protective visits. This program identifies, assesses, and mitigates any risks posed by information systems to persons and facilities protected by the Secret Service. It also conducts protective advances to identify, assess, and mitigate any issues identified with networks or systems that could adversely affect the physical security plan or cause physical harm to a protectee. The advances support all of the Secret Service’s protective detail offices by implementing network monitoring, and applying cyber intelligence analysis. Additionally, the program supports full spectrum protective visits, events, or venues domestically, in foreign countries, special events, and national special security events. In addition, Secret Service personnel in Los Angeles have engaged with maritime port stakeholders in Los Angeles and Long Beach in several ways. For example, Secret Service staff gave a general cybersecurity threat presentation to port stakeholders, though no specific cyber threats to the maritime port environment were discussed. In addition, Secret Service was requested by a local governmental entity to assist in assessing the cyber aspects of critical infrastructure. Secret Service officials stated that they are still very early on in this process and are currently working with the entity to identify the critical assets/components of the cyber infrastructure. The process is still in the information-gathering phase, and officials do not expect to release any sort of summary product until mid-2014 at the earliest. Officials stated that the end product would detail any potential vulnerabilities identified during the assessment and make recommendations for mitigation that the stakeholder could implement if it chooses. Secret Service officials also stated that an evaluation was conducted under the Critical Systems Protection Program with a maritime port stakeholder in the Houston area, but did not provide details regarding this evaluation. The Transportation Security Administration (TSA) is the former lead sector-specific agency for the transportation systems sector. TSA currently co-leads the sector with the Department of Transportation and Coast Guard, and it supports, as needed, the Coast Guard’s lead for maritime security. TSA also uses the Transportation Sector Security Risk Assessment to determine relative risks for the transportation modes. However, according to TSA officials, Coast Guard and TSA agreed in 2009 that the maritime modal risk assessment would be addressed in a separate report. TSA also established the Transportation Systems Sector Cybersecurity Working Group, whose meetings (under the Critical Infrastructure Partnership Advisory Council framework) have discussed maritime cybersecurity issues. Although components of the Department of Commerce do have maritime- related efforts under way, none are directly related to the cybersecurity of the port environment. Further, the National Institute of Standards and Technology (NIST) has not developed any specific standards related to the cybersecurity of maritime facilities within our scope. NIST has started to work with private sector stakeholders from different critical infrastructure sectors to develop a voluntary framework for reducing cyber risks to critical infrastructure, as directed by Executive Order 13636. It is developing this voluntary framework in accordance with its mission to promote U.S. innovation and industrial competitiveness. The framework has been shaped through ongoing public engagement. According to officials, more than 3,000 people representing diverse stakeholders in industry, academia, and government have participated in the framework’s development through attendance at a series of public workshops and by providing comments on drafts. On February 12, 2014, NIST released the cybersecurity framework. Though representatives from numerous critical infrastructure sectors provided comments on the draft framework, only one maritime entity provided feedback, in October 2013. The entity stated that the framework provided a minimum level of cybersecurity information, but may not provide sufficient guidance to all relevant parties who choose to implement its provisions and suggestions. Additionally, the entity stated that it found the framework to be technical in nature and that it does not communicate at a level helpful for business executives. Department of Commerce officials stated that NIST worked to address these comments in the final version of the framework. The mission of the Department of Transportation is to serve the United States by ensuring a fast, safe, efficient, accessible, and convenient transportation system that meets our vital national interest and enhances the quality of life of the American people. The department is organized into several administrations, including the Research and Innovative Technology Administration, which coordinates the department’s research programs and is charged with advancing the deployment of cross-cutting technologies to improve the nation’s transportation networks. The administration includes the Volpe Center, which partners with public and private organizations to assess the needs of the transportation community, evaluate research and development endeavors, assist in the deployment of state-of-the-art transportation technologies, and inform decision- and policy-making through analyses. Volpe is funded by sponsoring organizations. In 2011, Volpe entered into a 2-year agreement with DHS’s Control Systems Security Program to evaluate the use of control systems in the transportation sector, including the maritime mode. Under this agreement, Volpe and DHS developed a road map to secure control systems in the transportation sector in August 2012. The document discussed the use of industrial control systems in the maritime mode, and described high-level threats. It also established several goals for the entire transportation sector with near- (0-2 years), mid- (2-5 years), and long-term (5-10 years) objectives, metrics, and milestones. Volpe and DHS also developed a cybersecurity standards strategy for transportation industrial control systems, which identified tasks for developing standards for port industrial control systems starting in 2015. Volpe also conducted outreach to various maritime entities. According to Volpe officials, this study was conducted mostly at international port facilities and vessels (though U.S. ports were visited under a different program). The officials stated that the agreement was canceled due to funding reductions resulting from the recent budget sequestration. DHS officials gave two reasons why funding for Volpe outreach was terminated after sequestration. First, as part of a reorganization of the Office of Cybersecurity and Communications, there is a heightened focus on “operational” activities, and DHS characterized Volpe’s assistance under the agreement as outreach and awareness. Second, the officials stated that because the demand for incident management and response continues to grow, a decision was made to stop funding Volpe to meet spending cuts resulting from sequestration and increase funding for cyber incident response for critical infrastructure asset owners and operators who use industrial control systems. Although components of the Department of Justice have some efforts under way, most of those efforts occur at the port level. Specifically, the department’s Federal Bureau of Investigation is involved in several initiatives at the local level, focused on interfacing with key port stakeholders as well as relevant entities with state and local governments. These initiatives are largely focused on passing threat information to partners. Additionally, the Bureau’s Infragard program provides a forum to share threat information with representatives from all critical infrastructure sectors, including maritime. While the Department of Defense has recognized the significance of cyber-related threats to maritime facilities, the department has no explicit role in the protection of critical infrastructure within the maritime sub- sector. Officials also said that the department had not supported maritime mode stakeholders regarding cybersecurity. In addition, though the Department of Defense was identified as a member of the Maritime Modal Government Coordinating Council in the 2010 Transportation Systems Sector-Specific Plan, the department was not listed as a participant in the 2013 or 2014 council meetings. Further, DHS, including the U.S. Coast Guard, had not requested support from Defense on cybersecurity of commercial maritime port operations and facilities. Figure 2 provides an overview of the technologies used in the maritime port environment (see interactive fig. 1) and includes the figure’s rollover information. In addition to the contacts named above, key contributions to this report were made by Michael W. Gilmore (Assistant Director), Christopher Conrad (Assistant Director), Bradley W. Becker, Jennifer L. Bryant, Franklin D. Jackson, Tracey L. King, Kush K. Malhotra, Lee McCracken, Umesh Thakkar, and Adam Vodraska. National Preparedness: FEMA Has Made Progress, but Additional Steps Are Needed to Improve Grant Management and Assess Capabilities. GAO-13-637T. Washington, D.C.: June 25, 2013. Communications Networks: Outcome-Based Measures Would Assist DHS in Assessing Effectiveness of Cybersecurity Efforts. GAO-13-275. Washington, D.C.: April 3, 2013. High Risk Series: An Update. GAO-13-283. Washington, D.C.: February 14, 2013. Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be Better Defined and More Effectively Implemented. GAO-13-187. Washington, D.C.: February 14, 2013. Information Security: Better Implementation of Controls for Mobile Devices Should Be Encouraged. GAO-12-757. Washington, D.C.: September 18, 2012. Maritime Security: Progress and Challenges 10 Years after the Maritime Transportation Security Act. GAO-12-1009T. Washington, D.C.: September 11, 2012. Information Security: Cyber Threats Facilitate Ability to Commit Economic Espionage. GAO-12-876T. Washington, D.C.: June 28, 2012. IT Supply Chain: National Security-Related Agencies Need to Better Address Risks. GAO-12-361. Washington, D.C.: March 23, 2012. Homeland Security: DHS Needs Better Project Information and Coordination among Four Overlapping Grant Programs. GAO-12-303. Washington, D.C.: February 28, 2012. Critical Infrastructure Protection: Cybersecurity Guidance Is Available, but More Can Be Done to Promote Its Use. GAO-12-92. Washington, D.C.: December 9, 2011. Port Security Grant Program: Risk Model, Grant Management, and Effectiveness Measures Could Be Strengthened. GAO-12-47. Washington, D.C.: November 17, 2011. Coast Guard: Security Risk Model Meets DHS Criteria, but More Training Could Enhance Its Use for Managing Programs and Operations. GAO-12-14. Washington, D.C.: November 17, 2011. Information Security: Additional Guidance Needed to Address Cloud Computing Concerns. GAO-12-130T. Washington, D.C.: October 6, 2011. Cybersecurity: Continued Attention Needed to Protect Our Nation’s Critical Infrastructure. GAO-11-865T. Washington, D.C.: July 26, 2011. Critical Infrastructure Protection: Key Private and Public Cyber Expectations Need to Be Consistently Addressed. GAO-10-628. Washington, D.C.: July 15, 2010. Cyberspace: United States Faces Challenges in Addressing Global Cybersecurity and Governance. GAO-10-606. Washington, D.C.: July 2, 2010. Critical Infrastructure Protection: Current Cyber Sector-Specific Planning Approach Needs Reassessment. GAO-09-969. Washington, D.C.: September 24, 2009. Cyber Analysis and Warning: DHS Faces Challenges in Establishing a Comprehensive National Capability. GAO-08-588. Washington, D.C.: July 31, 2008. Homeland Security: DHS Improved its Risk-Based Grant Programs’ Allocation and Management Methods, But Measuring Programs’ Impact on National Capabilities Remains a Challenge. GAO-08-488T. Washington, D.C.: March 11, 2008. Maritime Security: Coast Guard Inspections Identify and Correct Facility Deficiencies, but More Analysis Needed of Program’s Staffing, Practices, and Data. GAO-08-12. Washington, D.C.: February 14, 2008. Cybercrime: Public and Private Entities Face Challenges in Addressing Cyber Threats. GAO-07-705. Washington, D.C.: June 22, 2007. Risk Management: Further Refinements Needed to Assess Risks and Prioritize Protective Measures at Ports and Other Critical Infrastructure. GAO-06-91. Washington, D.C.: December 15, 2005.

Summary: U.S. maritime ports handle more than $1.3 trillion in cargo annually. The operations of these ports are supported by information and communication systems, which are susceptible to cyber-related threats. Failures in these systems could degrade or interrupt operations at ports, including the flow of commerce. Federal agencies—in particular DHS—and industry stakeholders have specific roles in protecting maritime facilities and ports from physical and cyber threats. GAO's objective was to identify the extent to which DHS and other stakeholders have taken steps to address cybersecurity in the maritime port environment. GAO examined relevant laws and regulations; analyzed federal cybersecurity-related policies and plans; observed operations at three U.S. ports selected based on being a high-risk port and a leader in calls by vessel type, e.g. container; and interviewed federal and nonfederal officials. Actions taken by the Department of Homeland Security (DHS) and two of its component agencies, the U.S. Coast Guard and Federal Emergency Management Agency (FEMA), as well as other federal agencies, to address cybersecurity in the maritime port environment have been limited. While the Coast Guard initiated a number of activities and coordinating strategies to improve physical security in specific ports, it has not conducted a risk assessment that fully addresses cyber-related threats, vulnerabilities, and consequences. Coast Guard officials stated that they intend to conduct such an assessment in the future, but did not provide details to show how it would address cybersecurity. Until the Coast Guard completes a thorough assessment of cyber risks in the maritime environment, the ability of stakeholders to appropriately plan and allocate resources to protect ports and other maritime facilities will be limited. Maritime security plans required by law and regulation generally did not identify or address potential cyber-related threats or vulnerabilities. This was because the guidance issued by Coast Guard for developing these plans did not require cyber elements to be addressed. Officials stated that guidance for the next set of updated plans, due for update in 2014, will include cybersecurity requirements. However, in the absence of a comprehensive risk assessment, the revised guidance may not adequately address cyber-related risks to the maritime environment. The degree to which information-sharing mechanisms (e.g., councils) were active and shared cybersecurity-related information varied. Specifically, the Coast Guard established a government coordinating council to share information among government entities, but it is unclear to what extent this body has shared information related to cybersecurity. In addition, a sector coordinating council for sharing information among nonfederal stakeholders is no longer active, and the Coast Guard has not convinced stakeholders to reestablish it. Until the Coast Guard improves these mechanisms, maritime stakeholders in different locations are at greater risk of not being aware of, and thus not mitigating, cyber-based threats. Under a program to provide security-related grants to ports, FEMA identified enhancing cybersecurity capabilities as a funding priority for the first time in fiscal year 2013 and has provided guidance for cybersecurity-related proposals. However, the agency has not consulted cybersecurity-related subject matter experts to inform the multi-level review of cyber-related proposals—partly because FEMA has downsized the expert panel that reviews grants. Also, because the Coast Guard has not assessed cyber-related risks in the maritime risk assessment, grant applicants and FEMA have not been able to use this information to inform funding proposals and decisions. As a result, FEMA is limited in its ability to ensure that the program is effectively addressing cyber-related risks in the maritime environment. GAO recommends that DHS direct the Coast Guard to (1) assess cyber-related risks, (2) use this assessment to inform maritime security guidance, and (3) determine whether the sector coordinating council should be reestablished. DHS should also direct FEMA to (1) develop procedures to consult DHS cybersecurity experts for assistance in reviewing grant proposals and (2) use the results of the cyber-risk assessment to inform its grant guidance. DHS concurred with GAO's recommendations.