Threats to IT systems, both intentional and unintentional, are evolving and growing. Unintentional or nonadversarial threat sources include failures in equipment, environmental controls, or software due to aging, resource depletion, or other circumstances that exceed expected operating parameters. These threats also include natural disasters and failures of critical infrastructure on which the organization depends but are outside of the control of the organization. Intentional or adversarial threats include individuals, groups, entities, or nations that seek to leverage for illegal purposes the organization’s dependence on cyber resources (i.e., information in electronic form, information and communications technologies, and the communications and information-handling capabilities provided by those technologies). Threats can come from a wide array of sources, including corrupt employees, criminal groups, and terrorists. These threat adversaries vary in terms of their capabilities, their willingness to act, and their motives, which can include seeking monetary gain, or seeking an economic, political, or military advantage. Cyber threat adversaries make use of various techniques, tactics, and practices, or exploits, to adversely affect an organization’s computers, software, or networks, or to intercept or steal valuable or sensitive information. Further, adversaries can leverage common computer software programs, such as Adobe Acrobat and Microsoft Office, as a means by which to deliver a threat by embedding exploits within software files that can be activated when a user opens a file within its corresponding program. Appendix II contains tables of the sources of cyber-based threats, as well as descriptions of common cyber exploits, and the tactics, techniques, and practices used by cyber adversaries. Until fiscal year 2016, the number of information security incidents reported by federal agencies to DHS’s United States Computer Emergency Readiness Team (US-CERT) had steadily increased each year. From fiscal year 2006 through fiscal year 2015, reported incidents increased from 5,503 to 77,183, an increase of 1,303 percent. However, the number of reported incidents decreased by 60 percent in fiscal year 2016 to 30,899, as shown in figure 1. Changes in federal incident reporting guidelines likely contributed to the decrease in reported incidents between fiscal years 2015 and 2016. Updated incident reporting guidelines that became effective in fiscal years 2016 and 2017 no longer required agencies to report noncyber incidents or incidents categorized as scans, probes, and attempted access. In addition, an official from DHS’s National Cybersecurity and Communications Integration Center cited the expanded use of the National Cybersecurity Protection System to detect or block potentially malicious network traffic entering networks at federal agencies as another possible reason for fewer reported incidents. Different types of incidents merit different response strategies; however, if an agency cannot identify the threat vector, it could be difficult for that agency to define more specific handling procedures to respond to the incident. As shown in figure 2, incidents with a threat vector categorized as “other” make up 38 percent of the various incidents reported to US- CERT in fiscal year 2016. These incidents and others like them can pose a serious challenge to economic, national, and personal privacy and security. The following examples highlight the impact of such incidents: In April 2017, the Commissioner of the Internal Revenue Service (IRS) testified that the IRS had disabled its data retrieval tool in early March after becoming concerned about the misuse of taxpayer data. Specifically, the agency suspected that personally identifiable information obtained outside the agency’s tax system was used to access the agency’s online federal student aid application in an attempt to secure tax information through the data retrieval tool. In April 2017, the agency began notifying taxpayers who could have been affected by the breach. In October 2016, the Department of the Treasury’s Office of the Comptroller of the Currency notified us of a major incident it had identified in September 2016. Concurrent with a new policy that restricted employees’ use of removable media devices to prevent users from downloading information onto the devices without approval and review, the agency began reviewing employee downloads to removable media devices. During the review, it identified a significant change in download patterns for a former employee in the weeks before the employee’s separation from the agency. The former employee had downloaded approximately 28,000 files that may have contained controlled unclassified information onto two encrypted external thumb-drive devices. As of October 2016, the agency had been unable to recover the devices storing the files. Congress enacted FISMA to improve federal cybersecurity and clarify governmentwide responsibilities. As amended in 2014, the act is intended to address the increasing sophistication of cybersecurity attacks, promote the use of automated security tools with the ability to continuously monitor and diagnose the security posture of federal agencies, and provide for improved oversight of federal agencies’ information security programs. Specifically, the act clarifies and assigns additional responsibilities to OMB, DHS, and federal agencies in the executive branch, including: Develop and oversee the implementation of policies, principles, standards, and guidelines on information security in federal agencies except with regard to national security systems. Require agencies to identify and provide information security protections commensurate with assessments of risk to their information and information systems. Ensure that DHS carries out its FISMA responsibilities. Coordinate information security policies and procedures with related information resources management policies and procedures. Report annually, in consultation with DHS, on the effectiveness of information security policies and practices, including a summary of major agency information security incidents, an assessment of agency compliance with NIST standards, and an assessment of agency compliance with breach notification requirements. Ensure that data breach notification policies and guidelines are periodically updated and require notification to congressional committees and affected individuals. Ensure development of guidance for evaluating the effectiveness of an information security program and practices, in consultation with DHS, the Chief Information Officers Council (CIO) Council, the Council of the Inspectors General on Integrity and Efficiency (CIGIE), and other interested parties, as appropriate. Administer the implementation of agency information security policies and practices for non-national security information systems, in consultation with OMB, including. Assist OMB in fulfilling its FISMA authorities, including the development of policies and oversight of agencies’ compliance with FISMA requirements; Develop, issue, and oversee implementation of binding operational directives to agencies, such as those for incident reporting, contents of annual agency reports, and other operational requirements; Monitor agency implementation of information security policies Convene meetings with senior agency officials to help ensure their effective implementation of information security policies and practices; and Operate the federal information security incident center, deploy technology to continuously diagnose and mitigate threats, compile and analyze data on agency information security, and develop and conduct targeted operational evaluations, including threat and vulnerability assessments of systems. Establish standards for categorizing information and information systems according to ranges of risk-levels (See Federal Information Processing Standards 199 and 200); Develop minimum security requirements for information and information systems in each of the risk categories; Develop guidelines for detection and handling of information security Develop guidelines, in conjunction with the Department of Defense, for identifying an information system as a national security system. Executive branch agencies’ responsibilities Develop, document, and implement an agencywide information security program that includes the following components: periodic risk assessments, which may include using automated tools consistent with NIST standards and guidelines; policies and procedures that (1) are based on risk assessment, (2) cost-effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the lifecycle of each system, and (4) ensure compliance with applicable requirements; plans for providing adequate information security for networks, facilities, and systems or groups of information systems, as appropriate; security awareness training to inform personnel of information security risks and of their responsibilities for complying with agency policies and procedures, as well as training personnel with significant security responsibilities for information security; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk (but no less than annually); such testing should include using automated tools consistent with NIST standards and guidelines; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices; procedures for detecting, reporting, and responding to security incidents, which may include using automated tools; and plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. Comply with DHS binding operational directives in addition to OMB policies and procedures and NIST standards. Ensure that senior officials carry out assigned responsibilities and that all personnel are held accountable for complying with the agency’s information security program. Report major security incidents to Congress within 7 days. In addition, executive branch agencies are to report annually to OMB, certain congressional committees, and the comptroller general of the United States on the adequacy and effectiveness of their information security policies, procedures, and practices, and their compliance with the act. Further, FISMA requires agencies to include descriptions of major incidents in these annual reports. It also requires each agency inspector general, or independent auditor, to annually assess the effectiveness of the information security policies, procedures, and practices of the agency. Each year, OMB requires agencies to report how much their agency spends on information security. In fiscal year 2016, each of the 23 civilian agencies covered by the CFO Act reported spending between $3 million and about $1.3 billion on IT security-related activities. Agency reported spending on IT security-related activities ranged between 1 percent and 22 percent of the agencies’ IT budget and between 1 percent and 21 percent of their reported IT spending, as seen in table 1. Weaknesses in security controls such as access controls, configuration management, and security management, indicate that agencies did not adequately or effectively implement information security policies and practices during fiscal year 2016. Further, our work and reviews by inspectors general highlighted information security control deficiencies at agencies that expose information and information systems supporting federal operations and assets to elevated risk of unauthorized use, disclosure, modification, and disruption.