As computer technology has advanced, both government and private entities have become increasingly dependent on computerized information systems to carry out operations and to process, maintain, and report essential information. Public and private organizations rely on computer systems to transmit proprietary and other sensitive information, develop and maintain intellectual capital, conduct operations, process business transactions, transfer funds, and deliver services. In addition, the Internet has grown increasingly important to American businesses and consumers, serving as a medium for hundreds of billions of dollars of commerce each year, and has developed into an extended information and communications infrastructure that supports vital services such as power distribution, health care, law enforcement, and national defense. Ineffective protection of these information systems and networks can result in a failure to deliver these vital services, and result in loss or theft of computer resources, assets, and funds; inappropriate access to and disclosure, modification, or destruction of sensitive information, such as national security information, PII, and proprietary business information; disruption of essential operations supporting critical infrastructure, national defense, or emergency services; undermining of agency missions due to embarrassing incidents that erode the public’s confidence in government; use of computer resources for unauthorized purposes or to launch attacks on other systems; damage to networks and equipment; and high costs for remediation. Recognizing the importance of these issues, Congress enacted laws intended to improve the protection of federal information and systems. These laws include the Federal Information Security Modernization Act of 2014 (FISMA), which, among other things, authorizes DHS to (1) assist the Office of Management and Budget (OMB) with overseeing and monitoring agencies’ implementation of security requirements; (2) operate the federal information security incident center; and (3) provide agencies with operational and technical assistance, such as that for continuously diagnosing and mitigating cyber threats and vulnerabilities. The act also reiterated the 2002 FISMA requirement for the head of each agency to provide information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information or information systems. In addition, the act continues the requirement for federal agencies to develop, document, and implement an agency-wide information security program. The program is to provide security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. Risks to cyber-based assets can originate from unintentional or intentional threats. Unintentional threats can be caused by, among other things, natural disasters, defective computer or network equipment, and careless or poorly trained employees. Intentional threats include both targeted and untargeted attacks from a variety of sources, including criminal groups, hackers, disgruntled employees, foreign nations engaged in espionage and information warfare, and terrorists. These adversaries vary in terms of their capabilities, willingness to act, and motives, which can include seeking monetary gain or a political, economic, or military advantage. For example, adversaries possessing sophisticated levels of expertise and significant resources to pursue their objectives—sometimes referred to as “advanced persistent threats”— pose increasing risks. Table 1 describes common cyber adversaries. These adversaries make use of various techniques— or exploits—that may adversely affect federal information, computers, software, networks, and operations. Table 2 describes common types of cyber exploits. An adversary may employ multiple tactics, techniques, and exploits to conduct a cyber attack. The National Institute of Standards and Technology (NIST) has identified several representative events that may constitute a cyber attack: Perform reconnaissance and gather information: An adversary may gather information on a target by, for example, scanning its network perimeters or using publicly available information. Craft or create attack tools: An adversary prepares its means of attack by, for example, crafting a phishing attack or creating a counterfeit (“spoof”) website. Deliver, insert, or install malicious capabilities: An adversary can use common delivery mechanisms, such as e-mail or downloadable software, to insert or install malware into its target’s systems. Exploit and compromise: An adversary may exploit poorly configured, unauthorized, or otherwise vulnerable information systems to gain access. Conduct an attack: Attacks can include efforts to intercept information or disrupt operations (e.g., denial of service or physical attacks). Achieve results: Desired results include obtaining sensitive information via network “sniffing” or exfiltration, causing degradation or destruction of the target’s capabilities; damaging the integrity of information through creating, deleting, or modifying data; or causing unauthorized disclosure of sensitive information. Maintain a presence or set of capabilities: An adversary may try to maintain an undetected presence on its target’s systems by inhibiting the effectiveness of intrusion-detection capabilities or adapting behavior in response to the organization’s surveillance and security measures. More generally, the nature of cyber-based attacks can vastly enhance their reach and impact. For example, cyber attacks do not require physical proximity to their victims, can be carried out at high speeds and directed at multiple victims simultaneously, and can more easily allow attackers to remain anonymous. These inherent advantages, combined with the increasing sophistication of cyber tools and techniques, allow threat actors to target government agencies and their contractors, potentially resulting in the disclosure, alteration, or loss of sensitive information, including PII; theft of intellectual property; destruction or disruption of critical systems; and damage to economic and national security. Since fiscal year 2006, the number of information security incidents affecting systems supporting the federal government has steadily increased each year: rising from 5,503 in fiscal year 2006 to 67,168 in fiscal year 2014, an increase of 1,121 percent. (See fig. 1.) Furthermore, the number of reported security incidents involving PII at federal agencies has more than doubled in recent years—from 10,481 incidents in fiscal year 2009 to 27,624 incidents in fiscal year 2014. Figure 2 shows the different types of incidents reported in fiscal year 2014. These incidents and others like them can adversely affect national security; damage public health and safety; and lead to inappropriate access to and disclosure, modification, or destruction of sensitive information. Recent examples highlight the impact of such incidents: In June 2015, OPM reported that an intrusion into its systems affected personnel records of about 4 million current and former federal employees. The Director of OPM also stated that a separate incident may have compromised OPM systems related to background investigations, but its scope and impact have not yet been determined. In June 2015, the Commissioner of the Internal Revenue Service (IRS) testified that unauthorized third parties had gained access to taxpayer information from its “Get Transcript” application. According to IRS, criminals used taxpayer-specific data acquired from non-IRS sources to gain unauthorized access to information on approximately 100,000 tax accounts. These data included Social Security information, dates of birth, and street addresses. In April 2015, the Department of Veterans Affairs (VA) Office of Inspector General reported that two VA contractors had improperly accessed the VA network from foreign countries using personally owned equipment. In February 2015, the Director of National Intelligence stated that unauthorized computer intrusions were detected in 2014 on OPM’s networks and those of two of its contractors. The two contractors were involved in processing sensitive PII related to national security clearances for federal employees. In September 2014, a cyber-intrusion into the United States Postal Service’s information systems may have compromised PII for more than 800,000 of its employees. Given the risks posed by cyber threats and the increasing number of incidents, it is crucial that federal agencies take appropriate steps to secure their systems and information. We and agency inspectors general have identified challenges in protecting federal information and systems, including those in the following key areas: Designing and implementing risk-based cybersecurity programs at federal agencies. Agencies continue to have shortcomings in assessing risks, developing and implementing security controls, and monitoring results. Specifically, for fiscal year 2014, 19 of the 24 federal agencies covered by the Chief Financial Officers (CFO) Actreported that information security control deficiencies were either a material weakness or a significant deficiency in internal controls over Moreover, inspectors general at 23 of the 24 their financial reporting.agencies cited information security as a major management challenge for their agency. As we testified in April 2015, for fiscal year 2014, most of the agencies had weaknesses in the five key security control categories. These control categories are (1) limiting, preventing, and detecting inappropriate access to computer resources; (2) managing the configuration of software and hardware; (3) segregating duties to ensure that a single individual does not have control over all key aspects of a computer-related operation; (4) planning for continuity of operations in the event of a disaster or disruption; and (5) implementing agency-wide security management programs that are critical to identifying control deficiencies, resolving problems, and managing risks on an ongoing basis. (See fig. 3.) Examples of these weaknesses include: (1) granting users access permissions that exceed the level required to perform their legitimate job-related functions; (2) not ensuring that only authorized users can access an agency’s systems; (3) not using encryption to protect sensitive data from being intercepted and compromised; (4) not updating software with the current versions and latest security patches to protect against known vulnerabilities; and (5) not ensuring employees were trained commensurate with their responsibilities. We and agency inspectors general have made hundreds of recommendations to agencies aimed at improving their implementation of these information security controls. Enhancing oversight of contractors providing IT services. In August 2014, we reported that five of six agencies we reviewed were inconsistent in overseeing assessments of contractors’ implementation of security controls. This was partly because agencies had not documented IT security procedures for effectively overseeing contractor performance. In addition, according to OMB, 16 of 24 agency inspectors general determined that their agency’s program for managing contractor systems lacked at least one required element.