Federal law and policy have established roles and responsibilities for federal agencies to work with industry in enhancing the physical and cyber-security of critical government and industry infrastructures. For example, consistent with law, presidential policies stress the importance of coordination between the government and industry to protect the nation’s cyber critical infrastructure. In addition, policies establish DHS as the focal point for the security of cyberspace—including analysis, warning, information sharing, vulnerability reduction, mitigation efforts, and recovery efforts for government and industry critical infrastructure and information systems. Federal policy also establishes critical infrastructure sectors, assigns federal agencies responsibilities over each sector (known as sector-specific agencies), and encourages industry involvement. A fundamental component of DHS’s efforts to protect and secure our nation’s infrastructure is its partnership approach, whereby it engages in partnerships among government and industry stakeholders. In 2006, DHS issued the National Infrastructure Protection Plan (NIPP), which provides the overarching approach for integrating the nation’s critical infrastructure protection and resilience activities into a single national effort. The NIPP also outlines the roles and responsibilities of DHS with regard to critical infrastructure protection and resilience and sector-specific agencies— federal departments and agencies responsible for critical infrastructure protection and resilience activities in 16 critical infrastructure sectors— such as the dams, energy, and transportation sectors. Appendix I lists the 16 critical infrastructure sectors and their sector-specific agencies. The NIPP emphasizes the importance of collaboration, partnering, and voluntary information sharing among DHS and industry owners and operators, and state, local, and tribal governments. The NIPP also stresses a partnership approach between the federal and state governments, and industry stakeholders for developing, implementing, and maintaining a coordinated national effort to manage the risks to critical infrastructure. Specific laws and directives have guided DHS’s role in critical infrastructure protection, including the Homeland Security Act of 2002, as amended; Homeland Security Presidential Directive/HSPD-7; Presidential Policy Directive/PPD-21, which was issued on February 12, 2013; and Executive Order 13636, which was also issued on February 12, 2013. PPD-21 directs DHS to, among other things, coordinate the overall federal effort to promote the security and resilience of the nation’s critical infrastructure. PPD-21 also recognizes that DHS, in carrying out its responsibilities under the Homeland Security Act, evaluates national capabilities, opportunities, and challenges in protecting critical infrastructure; analyzes threats to, vulnerabilities of, and potential consequences from all hazards on critical infrastructure; identifies security and resilience functions that are necessary for effective stakeholder engagement with all critical infrastructure sectors; integrates and coordinates federal cross-sector security and resilience activities; and identifies and analyzes key interdependencies among critical infrastructure sectors, among other things. Executive Order 13636 directs DHS to, among other things, develop a voluntary cybersecurity framework; promote and incentivize the adoption of cybersecurity practices; increase the volume, timeliness, and quality of cyber threat information sharing; and incorporate privacy and civil liberties protections into every initiative to secure our critical infrastructure. Within DHS, the National Protection and Programs Directorate (NPPD) is responsible for working with public and industry infrastructure partners and leads the coordinated national effort to mitigate risk to the nation’s infrastructure through the development and implementation of the infrastructure protection program. Using a partnership approach, NPPD works with owners and operators of the nation’s infrastructure to develop, facilitate, and sustain strategic relationships and information sharing, including the sharing of best practices. NPPD also works with government and industry partners to coordinate efforts to establish and operate various councils intended to protect infrastructure and provide infrastructure functions to strengthen incident response. Our prior work has found that DHS and its partners have taken a number of steps intended to improve the security of our critical infrastructure. However, we have also identified a number of additional steps DHS could take to further improve its partnerships aimed at protecting our critical infrastructure. Specifically, our work has identified three key factors that can affect the implementation of the partnership approach used by DHS: (1) recognizing and addressing barriers to sharing information; (2) sharing the results of DHS assessments with industry and other stakeholders; and (3) measuring and evaluating the performance of DHS’s partnership efforts. Addressing pervasive and sustained computer-based and physical attacks to systems and operations and the critical infrastructures they support depends on effective partnerships between the government and industry owners and operators of critical infrastructure. Recognizing and addressing barriers to information sharing includes, among other things, identifying barriers to sharing information with partners, understanding information requirements, and determining partners’ reasons for participating in voluntary programs. Identifying barriers to industry sharing information with federal partners. In a July 2010 report examining, among other things, government stakeholders’ expectations for cyber-related, public- private partnerships we identified some barriers to industry’s sharing of cyber threat information with federal partners.of the government entities we contacted reported that industry partners were mostly meeting their expectations in several areas, including sharing timely and actionable cyber threat information, though the extent to which this was happening varied by sector. However, we found that federal officials also reported that improvements could be made. For example, while timely and actionable cyber threat and alert information was being received from industry partners, federal officials noted there were limits to the depth and specificity of the information provided by industry partners. Among other issues, we found that industry partners did not want to share their sensitive, proprietary information with the federal government. For example, information security companies had concerns that they could lose a competitive advantage by sharing information with the government if, in turn, this information was shared with those companies’ competitors. In addition, despite special protections and sanitization processes, we found that industry partners were unwilling to agree to all of the terms that the federal government or a government agency requires to share certain information. On the basis of our findings, we recommended, among other things, that DHS, in collaboration with industry partners, use the results of our July 2010 report to continue to focus its information- sharing efforts on the most desired services. DHS concurred with this recommendation and described steps underway to address it, including the initiation of several pilot programs intended to enable the mutual sharing of cybersecurity information at various classification levels. Identifying barriers to the government’s sharing information with industry partners. Federal efforts to meet the information-sharing expectations of industry partners are equally important in managing effective public-private partnerships to successfully protect cyber- reliant critical assets from a multitude of threats. In July 2010, we also examined industry partners’ expectations for cyber-related, public- private partnerships and identified some barriers to the federal government’s sharing of cyber threat information with its industry partners. We reported that federal partners were not consistently meeting industry’s information sharing expectations, including providing timely and actionable cyber threat information and alerts, according to industry partners we contacted at the time. We found that this was, in part, due to restrictions on the type of information that can be shared with industry partners. We reported that according to federal officials, DHS’s ability to provide information is affected by restrictions that do not allow individualized treatment of one industry partner over another industry partner—making it difficult to formally share specific information with entities that are being directly affected by a cyber threat. In addition, we reported in July 2010 that because DHS has responsibility for serving as the nation’s cyber analysis and warning center, it must ensure that its warnings are accurate. DHS vulnerability assessments are conducted during site visits at individual assets and are used to identify security gaps and provide options for consideration to mitigate these identified gaps. DHS security surveys are intended to gather information on an asset’s current security posture and overall security awareness. Security surveys and vulnerability assessments are generally asset-specific and are conducted at the request of asset owners and operators. assets crucial to national security, public health and safety, and the economy. We recommended, and DHS concurred, that it design and implement a mechanism for systematically assessing why owners and operators of high-priority assets decline to participate, and develop a road map, with time frames and milestones, for completing this effort. DHS stated that it had implemented a tracking system in October 2013 to capture data on the reason for declinations by owners and operators. Although DHS reports that it has taken or begun to take action on the open recommendations discussed above, we have not verified DHS’s progress implementing all of our recommendations. We will continue to monitor DHS’s efforts to implement these recommendations. Another important factor for DHS’s implementation of its partnership approach is sharing information on the results of its security assessments and surveys with industry partners and other stakeholders. Timely sharing of assessment results at the asset level. DHS security surveys and vulnerability assessments can provide valuable insights into the strengths and weaknesses of assets and can help asset owners and operators that participate in these programs make decisions about investments to enhance security and resilience. In our May 2012 report, we found that, among other things, DHS shares the results of security surveys and vulnerability assessments with asset owners or operators.security survey and vulnerability assessment results could be enhanced by the timely delivery of these products to the owners and operators and that the inability to deliver these products in a timely manner could undermine the relationship DHS was attempting to develop with these industry partners. Specifically, we reported that, based on DHS data from fiscal year 2011, DHS was late meeting its (1) 30-day time frame—as required by DHS guidance—for delivering the results of its security surveys 60 percent of the time and (2) 60- day time frame—expected by DHS managers for delivering the results of its vulnerability assessments—in 84 percent of the instances. DHS officials acknowledged the late delivery of survey and assessment results and said they were working to improve processes and However, we also found that the usefulness of protocols. However, DHS had not established a plan with time frames and milestones for managing this effort consistent with standards for project management.