As computer technology has advanced, federal agencies have become dependent on computerized information systems to carry out their operations and to process, maintain, and report essential information. Virtually all federal operations are supported by computer systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions, deliver services to the public, and account for their resources without these cyber assets. Information security is thus especially important for federal agencies to ensure the confidentiality, integrity, and availability of their systems and data. Conversely, ineffective information security controls can result in significant risk to a broad array of government operations and assets, as the following examples illustrate: Computer resources could be used for unauthorized purposes or to launch attacks on other computer systems. Sensitive information, such as personally identifiable information, intellectual property, and proprietary business information could be inappropriately disclosed, browsed, or copied for purposes of identity theft, espionage, or other types of crime. Critical operations, such as those supporting critical infrastructure, national defense, and emergency services, could be disrupted. Data could be added, modified, or deleted for purposes of fraud, subterfuge, or disruption. Government officials are increasingly concerned about attacks from individuals and groups with malicious intent, such as criminals, terrorists, and adversarial foreign nations. For example, in February 2009, the Director of National Intelligence testified that foreign nations and criminals have targeted government and private sector networks to gain a competitive advantage and potentially disrupt or destroy them, and that terrorist groups have expressed a desire to use cyber attacks as a means to target the United States. The growing connectivity between information systems, the Internet, and other infrastructures creates opportunities for attackers to disrupt telecommunications, electrical power, and other critical infrastructures. As government, private sector, and personal activities continue to move to networked operations, digital systems add ever more capabilities, wireless systems become more ubiquitous, and the design, manufacture, and service of information technology have moved overseas, the threat will continue to grow. Federal law and policy establish DHS as the focal point for efforts to protect our nation’s computer-reliant critical infrastructures —a practice known as cyber critical infrastructure protection, or cyber CIP. In this capacity, the department has multiple cybersecurity-related roles and responsibilities. In 2005, we identified, and reported on, 13 key cybersecurity responsibilities. They include, among others, (1) developing a comprehensive national plan for CIP, including cybersecurity; (2) developing partnerships and coordinating with other federal agencies, state and local governments, and the private sector; (3) developing and enhancing national cyber analysis and warning capabilities; (4) providing and coordinating incident response and recovery planning, including conducting incident response exercises; and (5) identifying, assessing, and supporting efforts to reduce cyber threats and vulnerabilities, including those associated with infrastructure control systems. Within DHS, the National Protection and Programs Directorate has primary responsibility for assuring the security, resiliency, and reliability of the nation’s cyber and communications infrastructure. DHS is also responsible for securing its own computer networks, systems, and information. FISMA requires the department to develop and implement an agencywide information security program to provide security for the information and information systems that support the operations and assets of the agency. Within DHS, the Chief Information Officer is responsible for ensuring departmental compliance with federal information security requirements. FISMA tasks NIST—a component within the Department of Commerce— with responsibility for developing standards and guidelines, including minimum requirements, for (1) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of the agency and (2) providing adequate information security for all agency operations and assets, except for national security systems. The act specifically required NIST to develop, for systems other than national security systems, (1) standards to be used by all agencies to categorize all their information and information systems based on the objectives of providing appropriate levels of information security, according to a range of risk levels; (2) guidelines recommending the types of information and information systems to be included in each category; and (3) minimum information security requirements for information and information systems in each category. NIST also is required to develop a definition of and guidelines for detection and handling of information security incidents as well as guidelines developed in conjunction with the Department of Defense and the National Security Agency for identifying an information system as a national security system. Within NIST, the Computer Security Division of the Information Technology Laboratory is responsible for developing information security related standards and guidelines. FISMA also requires NIST to take other actions that include: conducting research, as needed, to determine the nature and extent of information security vulnerabilities and techniques for providing cost- effective information security; developing and periodically revising performance indicators and measures for agency information security policies and practices; evaluating private sector information security policies and practices and commercially available information technologies, to assess potential application by agencies to strengthen information security; and assisting the private sector, in using and applying the results of its activities required by FISMA. In addition, the Cyber Security Research and Development Act required NIST to develop checklists to minimize the security risks for each hardware or software system that is, or likely to become, widely used within the federal government. FISMA also requires the Office of Management and Budget (OMB) to develop policies, principles, standards, and guidelines on information security and to report annually to Congress on agency compliance with the requirements of the act. OMB has provided instructions to federal agencies and their inspectors general for preparing annual FISMA reports. These instructions focus on metrics related to the performance of key control activities such as developing a complete inventory of major information systems, providing security training to personnel, testing and evaluating security controls, testing contingency plans, and certifying and accrediting systems. FISMA reporting provides valuable information on the status and progress of agency efforts to implement effective security management programs. Because the threats to federal information systems and critical infrastructure have persisted and grown, President Bush in January 2008 began to implement a series of initiatives—commonly referred to as the Comprehensive National Cybersecurity Initiative aimed primarily at improving DHS’s and other federal agencies’ efforts to protect against intrusion attempts and anticipate future threats. Since then, President Obama (in February 2009) directed the National Security Council and Homeland Security Council to conduct a comprehensive review to assess the United States’ cyber security related policies and structures. The resulting report, “Cyberspace Policy Review: Assuring a Trusted and Resilient Information and Communications Infrastructure,” recommended, among other things, appointing an official in the White House to coordinate the nation’s cybersecurity policies and activities, creating a new national cybersecurity strategy, and developing a framework for cyber research and development. In addition, we testified in March 2009 that a panel of experts identified 12 key areas of the national cybersecurity strategy requiring improvement, such as developing a national strategy that clearly articulates strategic objectives, goals, and priorities; bolstering the public/private partnership; and placing a greater emphasis on cybersecurity research and development. We have reported since 2005 that DHS has yet to comprehensively satisfy its key responsibilities for protecting computer-reliant critical infrastructures. Our reports included about 90 recommendations that we summarized into key areas, including those listed in table 1, that are essential for DHS to address in order to fully implement its responsibilities. DHS has since developed and implemented certain capabilities to satisfy aspects of its responsibilities, but the department still has not fully implemented our recommendations, and thus further action needs to be taken to address these areas. In July 2008, we identified that cyber analysis and warning capabilities included (1) monitoring network activity to detect anomalies, (2) analyzing information and investigating anomalies to determine whether they are threats, (3) warning appropriate officials with timely and actionable threat and mitigation information, and (4) responding to the threat. These four capabilities are comprised of 15 key attributes, including establishing a baseline understanding of the nation’s critical network assets and integrating analysis work into predictive analyses of broader implications or potential future attacks. We concluded that while DHS’s United States Computer Emergency Readiness Team (US-CERT) demonstrated aspects of each of the key attributes, it did not fully incorporate all of them. For example, as part of its monitoring, US-CERT obtained information from numerous external information sources; however, it had not established a baseline of the nation’s critical network assets and operations. In addition, while it investigated whether identified anomalies constituted actual cyber threats or attacks as part of its analysis, it did not integrate its work into predictive analyses of broader implications or potential future attacks, nor did it have the analytical or technical resources to analyze multiple, simultaneous cyber incidents. The organization also provided warnings by developing and distributing a wide array of attack and other notifications; however, these notifications were not consistently actionable or timely— i.e., providing the right information to the right persons or groups as early as possible to give them time to take appropriate action. Further, while the team responded to a limited number of affected entities in its efforts to contain and mitigate an attack, recover from damages, and remediate vulnerabilities, it did not possess the resources to handle multiple events across the nation. We also concluded that without fully implementing the key attributes, US- CERT did not have the full complement of cyber analysis and warning capabilities essential to effectively perform its national mission. As a result, we made 10 recommendations to the department to address shortfalls associated with the 15 attributes in order to fully establish a national cyber analysis and warning capability. DHS concurred and agreed to implement 9 of our 10 recommendations. In a September 2007 report and October 2007 testimony, we reported that DHS was sponsoring multiple control systems security initiatives, including an effort to improve control systems cybersecurity using vulnerability evaluation and response tools. However, DHS had not established a strategy to coordinate the various control systems activities across federal agencies and the private sector, and it did not effectively share information on control system vulnerabilities with the public and private sectors.