Critical infrastructures are systems and assets, whether physical or virtual, so vital to our nation that their incapacity or destruction would have a debilitating impact on national security, economic well-being, public health or safety, or any combination of these. Critical infrastructure includes, among other things, banking and financial institutions, telecommunications networks, and energy production and transmission facilities, most of which are owned by the private sector. As these critical infrastructures have become increasingly dependent on computer systems and networks, the interconnectivity among information systems, the Internet, and other infrastructures creates opportunities for attackers to disrupt critical systems, with potentially harmful effects. To better manage cyber-based risks that the nation’s cyber-reliant critical infrastructure faces, public and private organizations use available cybersecurity standards and guidance that promote the security of their critical systems. Threats to systems supporting critical infrastructure are evolving and growing. In February 2011, the Director of National Intelligence testified that, in the past year, there had been a dramatic increase in malicious cyber activity targeting U.S. computers and networks, including a more than tripling of the volume of malicious software since 2009. Cyber threats can be unintentional or intentional. Unintentional threats can be caused by software upgrades or maintenance procedures that inadvertently disrupt systems. Intentional threats include both targeted and untargeted attacks from a variety of sources, including criminal groups, hackers, disgruntled employees, foreign nations engaged in espionage and information warfare, and terrorists. GAO, Information Security: TVA Needs to Address Weaknesses in Control Systems and Networks, GAO-08-526 (Washington, D.C.: May 21, 2008). continue to move to networked operations, the threat will continue to grow. Table 1 provides descriptions of common types of cyber exploits. Reports of cyber attacks illustrate that such attacks could have a debilitating impact on national and economic security and on public health and safety. In June 2011, a major bank reported that hackers had broken into its systems and gained access to the personal information of hundreds of thousands of customers. Through the bank’s online banking system, the attackers were able to view certain private customer information. In February 2011, media reports stated that computer hackers had broken into and stolen proprietary information worth millions of dollars from the networks of six U.S. and European energy companies. In July 2010, a sophisticated computer attack, known as Stuxnet, was discovered. It targeted control systems used to operate industrial processes in the energy, nuclear, and other critical sectors. It is designed to exploit a combination of vulnerabilities to gain access to its target and modify code to change the process. Federal law and policy have established roles and responsibilities for federal agencies working with the private sector and other entities in enhancing the cyber and physical security of critical public and private infrastructures. These include the Homeland Security Act of 2002, Homeland Security Presidential Directive 7 (HSPD-7), and the National Infrastructure Protection Plan (NIPP). In addition, regulatory entities oversee entities within critical infrastructure sectors and develop and publish various types of cybersecurity guidance to assist their examiners and organizations. The Homeland Security Act of 2002 created the Department of Homeland Security (DHS). Among other things, it assigned the department the following critical infrastructure protection responsibilities: (1) developing a comprehensive national plan for securing the key resources and critical infrastructures of the United States; (2) assisting in the development and promotion of private sector best practices to secure critical infrastructure; and (3) disseminating, as appropriate, information to assist in the deterrence, prevention, and preemption of, or response to, terrorist attacks. HSPD-7 established DHS as the principal federal agency to lead, integrate, and coordinate the implementation of efforts to protect cyber- critical infrastructures and key resources. In addition, HSPD-7 identified lead federal agencies, referred to as sector-specific agencies, which are responsible for coordinating critical infrastructure protection efforts with the public and private stakeholders in their respective sectors. For example, the Department of the Treasury and the Department of Health and Human Services are the sector-specific agencies for the banking and finance and the health care and public health sectors, respectively. The NIPP states that, in accordance with HSPD-7, DHS is a principal focal point for the security of cyberspace and is responsible for coordinating efforts to protect the cyber infrastructure to ensure its confidentiality, integrity, and availability. These responsibilities, among other things, include providing guidance on effective cyber-protective measures, assisting the sector-specific agencies in understanding and mitigating cyber risk, and assisting in developing effective and appropriate protective measures. To accomplish these responsibilities, DHS is to help in the development of comprehensive cybersecurity guidance that homeland security partners may adopt to meet accepted industry-based standards that measurably reduce the risk of cyber disruption or exploitation. The NIPP also describes a partnership model as the primary means of coordinating government and private sector efforts to protect critical infrastructure. For each sector, the model requires formation of government coordinating councils—composed of federal, state, local, or tribal agencies with purview over critical sectors—and encourages voluntary formation of SCCs—composed of owner-operators of these critical assets (some of which may be state or local agencies) or their respective trade associations. These councils create the structure through which representative groups from all levels of government and the private sector are to collaborate in planning and implementing efforts to protect critical infrastructure. The sector councils are envisioned to be policy- related and to represent a primary point of contact for government to plan the entire range of infrastructure protection activities, including those associated with mitigating cyber threats. According to the NIPP, sector-specific agencies are to work with their private sector counterparts to understand and mitigate cyber risk by, among other things, determining whether approaches for critical infrastructure inventory, risk assessment, and protective measures address assets, systems, and networks; require enhancement; or require the use of alternative approaches. They are also to review and modify existing and future sector efforts to ensure that cyber concerns are fully integrated into sector security activities and protective activities. Table 2 shows the 18 critical infrastructure sectors and the sector-specific agencies assigned to each sector. Further, the NIPP called for the sector-specific agencies, in close collaboration with the sector coordinating councils, government coordinating councils, and others, including state, local, and tribal critical infrastructure key resources partners, to develop sector-specific plans and sector annual reports to address how the sectors would implement the national plan, including how the security of cyber and other (physical) assets and functions was to be improved. More specifically, according to the NIPP, sector plans were to, among other things, describe how the sector will identify and prioritize its critical cyber and other assets and define approaches to be taken to assess risks and develop programs to protect these assets, and sector annual reports were to provide status and progress on each sector’s efforts to carry out the sector plans. In September 2009, we reported that sector-specific agencies had made limited progress in updating their sector-specific plans to fully address key cyber elements. As a result, we recommended that the Secretary of Homeland Security, consistent with any direction from the Office of the Cybersecurity Coordinator, (1) assess whether the existing sector- specific planning process should continue to be the nation’s approach to securing cyber and other critical infrastructure and, in doing so, consider whether proposed and other options would provide more effective results and (2) if the existing approach is deemed to be the national approach, work with the sector-specific agencies to develop their plans to fully address DHS cybersecurity criteria. In response to our recommendations, DHS took steps to make sector-specific planning a priority. For example, in 2009 and 2010, DHS met and worked with the sector-specific agencies and sector representatives to update sector plans with the goal of fully addressing cyber-related criteria. As of October 2011, of the 18 plans, DHS reported that 17 have been finalized and approved and 1 is still in the process of being reviewed. In addition, DHS’s Quadrennial Homeland Security Review Report identified key strategic outcomes for the department’s safeguarding and securing cyberspace mission, including, among others, that the (1) homeland security partners develop, update, and implement guidelines, regulations, and standards that ensure the confidentiality, integrity, and reliability of systems, networks, and data, and (2) critical infrastructure sectors adopt and sector partners meet accepted standards that measurably reduce the risk of cyber disruption or exploitation. In addition to public-private partnership-related efforts, regulatory entities oversee entities within critical infrastructure sectors that are under the purview of federal law, regulation, or mandatory standards pertaining to securing privately owned information systems or data. For example, depository financial institutions (such as commercial banks and credit unions) in the banking and finance sector are regulated by members of the Federal Financial Institutions Examination Council (FFIEC). The mechanisms used to perform oversight include continuous examinations, periodic examinations, self-reporting, and compliance reviews, and various types of mechanisms exist to enforce compliance. Federal regulators also develop and publish various types of cybersecurity guidance to assist (1) the examiners and inspectors in carrying out their responsibilities and (2) the regulated entities in fulfilling requirements, addressing specific threats, or mitigating identified risks. For example, FFIEC has issued handbooks that are intended to provide guidance to examiners and organizations. Cybersecurity guidance provides general guidelines and principles as well as technical security techniques for maintaining the confidentiality, integrity, and availability of information systems and data. When implementing cybersecurity technologies and processes, organizations can avoid making common implementation mistakes by consulting guidance developed by various other organizations. Public and private organizations may decide to voluntarily adopt this guidance to help them manage cyber-based risks. Some entities may also be required to meet regulations or mandatory requirements that address cybersecurity.