Federal government contractors, including defense small businesses, face an evolving array of cyber-based threats. As we testified in April 2015, risks to cyber-based assets can originate from both unintentional and intentional threats. Unintentional threats can be caused by, among other things, defective computer or network equipment, and careless or poorly trained employees. Intentional threats include both targeted and untargeted attacks from a variety of sources, including criminal groups, hackers, disgruntled employees, foreign nations engaged in espionage and information warfare, and terrorists. Threat sources vary in terms of the capabilities of the actors, their willingness to act, and their motives, which can include monetary gain or political advantage, among others. For example, adversaries possessing sophisticated levels of expertise and significant resources to pursue their objectives—sometimes referred to as “advanced persistent threats”— pose increasing risks. Table 1 presents various sources of cyber threats. Threat sources make use of various techniques—or exploits—that may adversely affect information computers, software, networks, and operations. Table 2 presents various types of cyber exploits. The number of information security incidents reported by federal agencies to the U.S. Computer Emergency Readiness Team increased from 5,503 in fiscal year 2006 to 67,168 in fiscal year 2014, an increase of 1,121 percent. DOD has tasked DOD OSBP with ensuring that small businesses receive a fair proportion of DOD purchases, contracts, and subcontracts for property and services. This office is responsible for providing small business policy advice to the Office of the Secretary of Defense and for providing policy oversight to DOD military department and DOD component small business offices. Those offices are responsible for ensuring that small businesses are afforded the maximum practicable opportunity to participate in DOD acquisitions and establishing challenging small business program goals. DOD Directive 4205.01 states that DOD OSBP should take part in outreach and education on small business issues within DOD. Specifically, the directive states that DOD OSBP should establish and support a small business training program for Small Business Specialists and other acquisition personnel within DOD. In addition, DOD OSBP provides resources on the DOD OSBP website, and according to DOD OSBP officials, DOD OSBP also supports small businesses by providing outreach and education by attending small business conferences. However, according to DOD OSBP officials, none of those responsibilities requires the office to integrate cybersecurity into current or new outreach and education efforts. While DOD OSBP is responsible for leading DOD’s efforts to support small business initiatives, other DOD components support defense small businesses. For example, Military department small business office officials told us that their offices routinely provide outreach and education to small businesses on topics such as how to bid on DOD contracts; however, these efforts do not include outreach and education on cybersecurity issues. DOD Chief Information Officer manages the Defense Industrial Base Cyber Security/Information Assurance Program to address the pressing need to stem the risk posed by cyber attacks against defense industrial base businesses. According to DOD Instruction 5205.13, the program established a comprehensive approach for protecting unclassified DOD information transiting or residing on unclassified defense industrial base information systems and networks by incorporating the use of intelligence, operations, policies, standards, information sharing, expert advice and assistance, incident response, reporting procedures, and cyber intrusion damage assessment solutions to address a cyber advanced persistent threat. It was designed to establish a voluntary framework to prevent unauthorized access to DOD program information or the intellectual property of industry. This program is available only to a subset of small companies since participating companies must be approved to maintain classified information. The Defense Security Service manages the National Industrial Security Program for the Undersecretary of Defense for Intelligence, which governs cleared contractor companies and their cleared employees who support DOD and other federal agencies. The Defense Security Service has security oversight of these contractors, and provides them with related counterintelligence services and security education, awareness, and training; this includes the foreign threat to cleared contractors as an aspect of the counterintelligence mission. DOD has designated the Defense Security Service as its provider of security professional training and security awareness products for DOD personnel and for the cleared contractors. Under the National Industrial Security Program, the Defense Security Service receives, analyzes, and shares information on activity involving cleared contractor’s networks, regardless of the classification that may reflect foreign intelligence interests and acts in close coordination with the Federal Bureau of Investigation and other federal law enforcement and counterintelligence community members. In November 2013, DOD updated its Defense Federal Acquisition Regulation Supplement to include a contract clause that requires defense contractors and subcontractors to safeguard unclassified controlled technical information on their unclassified information systems from unauthorized access and disclosure and to report certain cyber incidents to DOD. In addition, under the required clause, contractors are to implement minimum privacy and security controls such as risk assessments that were developed by the National Institute of Standards and Technology, among other requirements. The 2015 DOD Cyber Strategy states that DOD must work with the private sector to help secure defense industrial base trade data. Furthermore, to safeguard critical programs and technologies, the strategy states that DOD will work with companies to develop alert capabilities and build layered cyber defenses. DOD OSBP officials have explored some ways whereby the office could integrate cybersecurity into its existing outreach and education efforts; however, as of July 2015, the office had not identified and disseminated information about cybersecurity resources in its outreach and education efforts to defense small businesses. While DOD OSBP is not required to educate small businesses on cybersecurity, DOD OSBP officials acknowledged that cybersecurity is an important and timely issue for small businesses—and therefore the office is considering incorporating cybersecurity into its existing outreach and education efforts. In response to our review, DOD OSBP officials contacted DOD Chief Information Officer officials in April 2015 to discuss options for integrating cybersecurity into their existing outreach and education efforts. According to DOD OSBP officials, the DOD OSBP and DOD Chief Information Officer officials discussed the development of training materials, such as online videos and brochures that could be distributed at small business conferences. The purpose of such training materials would be to help defense small businesses in understanding cybersecurity best practices, and the cybersecurity requirements identified in the Defense Federal Acquisition Regulation Supplement. According to DOD OSBP officials, the office also invited a DOD Chief Information Officer official to join a DOD OSBP representative to speak with small businesses about cybersecurity and to distribute a handout on cybersecurity and cyber business opportunities at a small business conference held in April 2015. In addition, recognizing that DOD’s small business offices may not be staffed by cybersecurity experts, DOD OSBP officials stated that they plan to add a cybersecurity component to a training curriculum that they are currently developing along with DOD Chief Information Officer for professionals who work in DOD small business offices. However, these efforts have not been completed and, as of July 2015, DOD OSBP had not identified or disseminated cybersecurity resources to defense small businesses that the businesses could use to understand cybersecurity and cyber threats. We identified 15 existing federal cybersecurity outreach and education resources that the office could leverage for defense small businesses. For example: DOD’s Defense Security Service offers online cybersecurity training programs that are available to the public on topics such as cybersecurity awareness, the National Institute of Standards and Technology’s Risk Management Framework, insider threats, and security controls through its public website. According to Defense Security Service officials, DOD small businesses could use the online training programs to improve their knowledge of cybersecurity. The U.S. Small Business Administration maintains a learning center that provides a 30-minute online program—available to small businesses—that covers cybersecurity concepts for small business. Topics include identifying and securing sensitive information, types of cyber threats, risk management, and best practices for guarding against cyber threats. The Department of Homeland Security, in coordination with the National Cyber Security Alliance and the Anti-Phishing Working Group, provides cyber awareness resources to the public—including cybersecurity awareness videos and tip sheets—on its Stop.Think.Connect website and facilitates cybersecurity awareness events targeted to various audiences, including businesses. This resource is available to defense small businesses. The Federal Communications Commission hosts a planning tool on its website, known as the FCC Small Biz Cyber Planner 2.0 that is targeted to small businesses and available to the public. This online planner provides guidance to small businesses on developing their cybersecurity plans and is available to defense small businesses. See appendix II for a listing of the 15 resources we identified. While DOD OSBP officials recognized the importance of identifying and disseminating cybersecurity resources through outreach and education efforts to defense small businesses, they also identified a number of factors that had, to date, limited their progress in doing so. Specifically, DOD OSBP officials were not aware of existing cybersecurity resources such as those we identified when we met with them in June 2015, there had been leadership turnover within the office, and the office had been focused on one of its key initiatives—developing the training curriculum for DOD professionals who work with small businesses. OSBP officials also stated that they had been focused on their statutory requirements such as training the DOD workforce that works with small businesses, advocating for small businesses within the government, and reaching out to small businesses in the private sector. While we recognize that these factors could affect progress, federal government internal controls state that management should ensure that there are adequate means of communicating with, and obtaining information from, external stakeholders who may have a significant impact on the agency’s achieving its goals. While they had not yet identified or disseminated information about existing cybersecurity resources to defense small businesses, officials agreed that doing so could help the businesses to become more aware of cybersecurity practices and cyber threats.