Although DHS reported many efforts under way and planned to improve the cyber content of sector-specific plans, sector-specific agencies have yet to update their respective sector-specific plans to fully address key DHS cyber security criteria. For example, of the 17 sector-specific plans, only 9 have been updated. Of these 9 updates, just 3 addressed missing cyber criteria, and those 3 involved only a relatively small number (3 or fewer) of the criteria in question. Sector-specific agencies did not fully address missing cyber criteria in their plans in large part due to the following: They were focused more on the physical rather than the cyber security aspects of the criteria in preparing their plans. They were unaware of the cyber criteria shortfalls identified in 2007. DHS’s guidance on updating sector plans did not specifically request the agencies to update the cyber security aspects of their plans. The continuing lack of plans that fully address key cyber criteria has reduced the effectiveness of the existing sector planning approach and thus increases the risk that the nation’s cyber assets have not been adequately identified, prioritized, and protected. Most sector-specific agencies developed and identified in their 2007 sector plans those actions—referred to by DHS as implementation actions— essential to carrying out the plans; however, since then, most agencies have not updated the actions and reported progress in implementing them as called for by DHS guidance. Specifically, in response to 2006 guidance that called for agencies in developing implementation actions to address three key elements (action descriptions, completion milestones, and responsible parties), most sectors initially developed implementation actions that fully addressed the key elements. However, while 2008 guidance called for implementation actions to be updated and for sector reports to include progress reporting against implementation action milestone commitments, only five sectors updated their plans and reported on implementation progress. DHS attributed this in part to the department not following up and working to ensure that all sector plans are fully developed and implemented in accordance with department guidance. The lack of complete updates and progress reports are further evidence that the sector planning process has not been effective and thus leaves the nation in the position of not knowing precisely where we stand in securing cyber-critical infrastructures. Although DHS reported many efforts under way and planned to improve the cyber content of sector-specific plans, sector-specific agencies have made limited progress in updating their sector-specific plans to fully address key cyber elements. Further, although the agencies produced narratives on sector activities, they have not developed effective implementation actions and reported on whether progress is being made in implementing their sector plans. This means that as a nation, we do not know precisely where we are in implementing sector plans and associated protective measures designed to secure and protect the nation’s cyber and other critical infrastructure, despite having invested many years in this effort. This condition is due in part to DHS not making sector planning a priority and as such, not managing it in a way that fully meets DHS guidance. These conclusions, taken as a whole, further raise fundamental questions about whether the current approach to sector planning is worthwhile and whether there are options that would provide better results. Consequently, it is essential that federal cyber security leaders— including DHS and the to-be-appointed Cybersecurity Coordinator—exert their leadership roles in this area by, among other things, determining whether it is worthwhile to continue with the current approach as implemented or consider if proposed options provide more effective results. To do less means the nation’s critical infrastructure sectors will continue to be at risk of not being able to adequately protect their cyber and other critical assets or be prepared to identify and respond to cyber threats and vulnerabilities. We recommend that the Secretary of Homeland Security, consistent with any direction from the Office of the Cybersecurity Coordinator, assess whether the existing sector-specific planning process should continue to be the nation’s approach to securing cyber and other critical infrastructure and, in doing so, consider whether proposed and other options would provide more effective results. If the existing approach is deemed to be the national approach, we also recommend that the Secretary make it, including the cyber aspects, an agency priority and mange it accordingly. This should include collaborating closely with other sector-specific agencies to develop sector-specific plans that fully address cyber-related criteria in the next release of the plans, and sector annual reports that (1) include updated implementation actions and associated milestones and (2) report progress against plan commitments and timelines. DHS concurred with our recommendations but took exception with certain report facts and conclusions that it said formed the basis for our recommendations. Specifically, in an email accompanying its written response—which was signed by the Director, Departmental GAO/OIG Liaison Office and is reprinted in appendix II—DHS said it concurred with our recommendation. In its written response, DHS added that it supported continually assessing the effectiveness of the sector approach and identifying and implementing improvements as appropriate. The department also stated in its written response that alternative options can be explored and implemented along with the current sector approach, rather than a binary choice between continuing the existing sector-specific planning approach and other options. We agree such efforts can be pursued in parallel and that doing them in this manner would be consistent with our recommendations. The department also commented that the report does not give due consideration to many of the ongoing sector and cross-sector cyber security activities identified in the annual reports and briefed to us. We recognize that DHS has multiple ongoing efforts to improve critical infrastructure protection (CIP) planning and implementation, and our report conclusions state this point. While our report for the sake of brevity does not include all of DHS’s efforts, it does include illustrative examples throughout as part of giving a fair and balanced view of DHS’s efforts in this area. Notwithstanding the concurrence discussed above, DHS in its written response took exception with our report’s facts and conclusions in nine areas—referred to by DHS as general items. Each of these general items, along with our response, is summarized below. General item 1: With regard to our report section that states that the sector-specific agencies have yet to update their respective plans to fully address key cyber security criteria as called for by DHS, the department commented that it established a risk management framework (as part of the 2006 National Infrastructure Protection Plan or NIPP) which called for cyber and other elements (i.e., human, physical) to be addressed. DHS added that its 2006 SSP guidance did not call for these elements to be addressed separately in the plans and at that time GAO had not identified the 30 cyber criteria in DHS’s guidance; therefore, when the 2007 SSPs were issued they did not fully address the 30 cyber criteria (which is consistent with our October 2007 report findings). To address this situation, DHS said it revised the NIPP in early 2009 to, among other things, provide for more robust coverage of cyber security using as a basis the 30 cyber criteria identified by GAO. In addition, in its guidance to the sector agencies in developing their 2010 SSPs, DHS directed the agencies to update their plans using the revised NIPP and in doing so, to fully address the 30 GAO-identified cyber criteria. GAO response: It is a positive development that DHS has issued guidance directing the sector agencies to fully address missing cyber criteria as part of having the sectors rewrite their SSPs in 2010. In addition, while we agree with DHS that its 2006 guidance did not call for cyber to be addressed separately in each SSP section, it is important to point out that DHS’s 2006 guidance nonetheless called for the sectors to address in the SSPs how they planned to secure the cyber aspects of their critical infrastructures. Consequently, the 2007 SSPs were to have addressed cyber in order to be in compliance with DHS’s guidance. In 2007, we initiated a review to assess the extent to which these plans addressed cyber. As part of that review, we analyzed the 2006 guidance and identified 30 cyber-related criteria that the critical infrastructure sectors were to address in their SSPs. Our analysis of the plans found them to be lacking in the cyber area and we subsequently recommended that DHS request that by September 2008, the sector agencies update their SSPs to address missing cyber-related criteria. DHS agreed with this recommendation, and stated that the department had initiated efforts to implement it. However, in following up on this recommendation and analyzing the cyber content of the sectors’ 2008 SSP updates (which was the first objective of this report), only 3 of the 17 sectors had updated their plans to address missing criteria. General item 2: Regarding the section of our report stating that the reason sector-specific agencies did not fully address missing cyber criteria in their plans was due in part to the fact that they were unaware of the cyber criteria shortfalls identified in our 2007 report, DHS described several initiatives it had taken to inform the agencies of their planning shortfalls. GAO response: We recognize that DHS has taken actions to inform the agencies of the shortfalls identified in our 2007 report. Accordingly, we cited illustrative examples of such actions throughout our report. Nonetheless, when we interviewed sector agencies officials, several stated that they were unaware of the GAO identified shortfalls, which raises questions about the effectiveness of DHS’s efforts. General item 3: DHS stated that while the SSPs have not been fully updated to include ongoing and planned cyber security activities, it does not mean there is a lack of cyber security planning in the sectors or that the planning to date has been ineffective. DHS also reiterated its earlier point that our report does not take into account many of its ongoing activities in the sector related to cyber security. In addition, the department commented that all the sectors reported on their progress in the 2008 annual reports. GAO response: We recognize that DHS has had many ongoing efforts related to improving the cyber content of SSPs and illustrative examples are provided throughout our report. However, the sector-specific agencies’ limited progress in addressing missing cyber content in their SSPs indicates a lack of effectiveness of planning.