Our work has identified the need for improvements in the federal government’s approach to cybersecurity of its systems and those supporting the nation’s critical infrastructures and in protecting the privacy of PII. While previous administrations and agencies have acted to improve the protections over the information and information systems supporting federal operations and U.S. critical infrastructure, additional actions are needed. Federal agencies need to effectively implement risk-based entity- wide information security programs consistently over time. Since the first FISMA was enacted in 2002, agencies have been challenged to fully and effectively develop, document, and implement the entity-wide information security program required by FISMA to protect the information and information systems that support their operations and assets, including those provided or managed by another agency or contractor. For example, as of February 7, 2017, 19 of 23 federal agencies covered by the Chief Financial Officers Act (CFO Act) that had issued their required annual financial reports for fiscal year 2016 reported that information security control deficiencies were either a material weakness or significant deficiency in internal controls over financial reporting for fiscal year 2016. In addition, inspectors general at 20 of the 23 agencies identified information security as a major management challenge for their agencies. Further, in light of these challenges, we have identified a number of actions to assist agencies in implementing their information security programs. Enhance capabilities to effectively identify cyber threats to agency systems and information. A key activity for assessing cybersecurity risk and selecting appropriate mitigating controls is the identification of cyber threats to computer networks, systems, and information. In 2016, we reported on several factors that agencies identified as impairing their ability to identify these threats to a great or moderate extent. The impairments included an inability to recruit and retain personnel with the appropriate skills, rapidly changing threats, continuous changes in technology, and a lack of government-wide information sharing mechanisms. Addressing these impairments will enhance the ability of agencies to identify the threats to their systems and information and be in a better position to select and implement appropriate countermeasures. Implement sustainable processes for securely configuring operating systems, applications, workstations, servers, and network devices. We routinely determine that agencies do not enable key information security capabilities of their operating systems, applications, workstations, servers, and network devices. Agencies were not always aware of the insecure settings that introduced risk to the computing environment. Establishing strong configuration standards and implementing sustainable processes for monitoring and enabling configuration settings will strengthen the security posture of federal agencies. Patch vulnerable systems and replace unsupported software. Federal agencies consistently fail to apply critical security patches on their systems in a timely manner, sometimes doing so years after the patch becomes available. We also consistently identify instances where agencies use software that is no longer supported by their vendors. These shortcomings often place agency systems and information at significant risk of compromise, since many successful cyberattacks exploit known vulnerabilities associated with software products. Using vendor-supported and patched software will help to reduce this risk. Develop comprehensive security test and evaluation procedures and conduct examinations on a regular and recurring basis. Federal agencies we reviewed often did not test or evaluate their information security controls in a comprehensive manner. The evaluations were sometimes based on interviews and document reviews, limited in scope, and did not identify many of the security vulnerabilities that our examinations identified. Conducting in-depth security evaluations that examine the effectiveness of security processes and technical controls is essential for effectively identifying system vulnerabilities that place agency systems and information at risk. Strengthen oversight of contractors providing IT services. As demonstrated by the OPM data breach of 2015, cyber attackers can sometimes gain entry to agency systems and information through the agency’s contractors or business partners. Accordingly, agencies need to assure that their contractors and partners are adequately protecting the agency’s information and systems. In August 2014, we reported that five of six selected agencies were inconsistent in overseeing the execution and review of security assessments that were intended to determine the effectiveness of contractor implementation of security controls, resulting in security lapses. In 2016, agency chief information security officers (CISOs) we surveyed reported that they were challenged to a large or moderate extent in overseeing their IT contractors and receiving security data from the contractors. This challenge diminished their ability to assess how well agency information maintained by the contractors is protected. Effectively overseeing and reviewing the security controls implemented by contractors and other parties is essential to ensuring that the agency’s information is properly safeguarded. We have several ongoing and planned audit engagements that will continue to assess the effectiveness of agency actions to implement information security programs. These engagements include in-depth assessments of information security programs at individual agencies including OPM and the Centers for Disease Control and Prevention as well as our biennial review of the adequacy of agencies’ information security policies and practices and their compliance with the provisions of FISMA. Also, on an annual basis, we evaluate information security controls over financial systems and information at seven agencies and incorporate the audit results of agency offices of inspector general during our annual audit of the consolidated financial statements of the federal government. In addition, we are currently conducting an assessment of the Federal Risk Authorization and Management Program and have plans to review cyber risk management practices and continuous monitoring programs at federal agencies. The federal government needs to improve its cyber incident detection, response, and mitigation capabilities. Even agencies or organizations with strong security can fall victim to information security incidents due to the existence of previously unknown vulnerabilities that are exploited by attackers to intrude into an agency’s information systems. Accordingly, agencies need to have effective mechanisms for detecting, responding to, and recovering from such incidents. We have previously identified various actions that could assist the federal government in building its capabilities for detecting, responding to, and recovering from security incidents. Expand capabilities, improve planning, and support wider adoption of the government-wide intrusion detection and prevention system. In January 2016, we reported that DHS’s National Cybersecurity Protection System (NCPS) had limited capabilities for detecting and preventing intrusions, conducting analytics, and sharing information. In addition, adoption of these capabilities at federal agencies was limited. We noted that expanding NCPS’s capabilities for detecting and preventing malicious traffic, defining requirements for future capabilities, and developing network routing guidance could increase assurance of the system’s effectiveness in detecting and preventing computer intrusions and support wider adoption by agencies. Improve cyber incident response practices at federal agencies. In April 2014 we reported that 24 major federal agencies did not consistently demonstrate that they had effectively responded to cyber incidents. For example, six agencies reviewed had not determined the impact of incidents or taken actions to address the underlying control weaknesses that allowed the incidents to occur, in part because they had not developed comprehensive policies, plans, and procedures for responding to security incidents, and had not tested their incident response capabilities. By developing comprehensive incident response policies, plans, and procedures for responding to incidents and effectively overseeing response activities, agencies will have increased assurance that they will effectively respond to cyber incidents. Update federal guidance on reporting data breaches and develop consistent responses to breaches of PII. As we reported in December 2013, eight agencies that we reviewed did not consistently implement policies and procedures for responding to breaches of PII. For example, none of the agencies had documented the evaluation of incidents and lessons learned. In addition, we noted that OMB guidance calling for agencies to report each PII-related incident— even those with inherently low risk to the individuals affected—within 1 hour of discovery may cause agencies to expend resources to meet reporting requirements that provide little value and divert time and attention from responding to breaches. We recommended that OMB update it guidance on federal agencies’ responses to a PII-related data breach and that the agencies we reviewed take steps to improve their response to data breaches involving PII. Updating guidance and consistently implementing breach response practices will improve the effectiveness of governmentwide and agency data breach response programs. GAO routinely evaluates agencies’ intrusion detection, response, and mitigation activities during audits of agency information security controls and programs. We plan to continue to do so during ongoing and future engagements. In addition, the Cybersecurity Act of 2015 contains a provision for us to study and publish a report by December 2018 on the effectiveness of the approach and strategy of the federal government to secure agency information systems, including the intrusion detection and prevention capabilities and the government’s intrusion assessment plan. The federal government needs to expand its cyber workforce planning and training efforts. Ensuring that the government has a sufficient number of cybersecurity professionals with the right skills and that its overall workforce is aware of information security responsibilities remains an ongoing challenge. Enhance efforts for recruiting and retaining a qualified cybersecurity workforce. This has been a long-standing dilemma for the federal government. In 2013, agency chief information officers and experts we surveyed cited weaknesses in education, awareness, and workforce planning as a root cause in hindering improvements in the nation’s cybersecurity posture. Several experts also noted that the cybersecurity workforce was inadequate, both in numbers and training. They cited challenges such as the lack of role-based qualification standards and difficulties in retaining cyber professionals. In 2016, agency chief information security officers we surveyed cited difficulties related to having sufficient staff; recruiting, hiring, and retaining security personnel; and ensuring that security personnel have appropriate skills and expertise as posing challenges to their abilities to carry out their responsibilities effectively. Improve cybersecurity workforce planning activities at federal agencies. In November 2011, we reported that only five of eight selected agencies had developed workforce plans that addressed cybersecurity. Further, all eight agencies reported challenges with filling cybersecurity positions, and only three of the eight had a department-wide training program for their cybersecurity workforce. GAO has two current engagements to further review cybersecurity workforce issues in the federal government. The Homeland Security Cybersecurity Workforce Assessment Act of 2014 contains a provision for us to monitor, analyze, and report by December 2017 on the Department of Homeland Security’s implementation of the National Cybersecurity Workforce Measurement Initiative.