As computer technology has advanced, federal agencies and our nation’s critical infrastructures—such as power distribution, water supply, telecommunications, and emergency services—have become increasingly dependent on computerized information systems to carry out their operations and to process, maintain, and report essential information. Public and private organizations rely on computer systems to transfer increasing amounts of money and sensitive and proprietary information, conduct operations, and deliver services to constituents. The security of these systems and data is essential to protecting national and economic security, and public health and safety. Conversely, ineffective information security controls can result in significant risks, including the loss of resources, such as federal payments and collections; inappropriate access to sensitive information, such as national security information, personal information on taxpayers, or proprietary business information; disruption of critical operations supporting critical infrastructure, national defense, or emergency services; and undermining of agency missions due to embarrassing incidents that diminish public confidence in government. Threats to systems supporting critical infrastructure and federal information systems are evolving and growing. Government officials are concerned about attacks from individuals and groups with malicious intent, such as criminals, terrorists, and foreign nations. Federal law enforcement and intelligence agencies have identified multiple sources of threats to our nation’s critical information systems, including foreign nations engaged in espionage and information warfare, criminals, hackers, virus writers, and disgruntled employees and contractors. These groups and individuals have a variety of attack techniques at their disposal that can be used to determine vulnerabilities and gain entry into targeted systems. For example, phishing involves the creation and use of fake e- mails and Web sites to deceive Internet users into disclosing their personal data and other sensitive information. The connectivity between information systems, the Internet, and other infrastructures also creates opportunities for attackers to disrupt telecommunications, electrical power, and other critical services. For example, in May 2008, we reported that the Tennessee Valley Authority’s (TVA) corporate network contained security weaknesses that could lead to the disruption of control systems networks and devices connected to that network. We made 19 recommendations to improve the implementation of information security program activities for the control systems governing TVA’s critical infrastructures and 73 recommendations to address weaknesses in information security controls. TVA concurred with the recommendations and has taken steps to implement them. As government, private sector, and personal activities continue to move to networked operations, the threat will continue to grow. Consistent with the evolving and growing nature of the threats to federal systems, agencies are reporting an increasing number of security incidents. These incidents put sensitive information at risk. Personally identifiable information about U.S. citizens has been lost, stolen, or improperly disclosed, thereby potentially exposing those individuals to loss of privacy, identity theft, and financial crimes. Agencies have experienced a wide range of incidents involving data loss or theft, computer intrusions, and privacy breaches, underscoring the need for improved security practices. Further, reported attacks and unintentional incidents involving critical infrastructure systems demonstrate that a serious attack could be devastating. When incidents occur, agencies are to notify the federal information security incident center—the United States Computer Emergency Readiness Team (US-CERT). Over the past 5 years, the number of incidents reported by federal agencies to US-CERT has increased dramatically, from 5,503 incidents reported in fiscal year 2006 to about 41,776 incidents in fiscal year 2010 (a more than 650 percent increase). The three most prevalent types of incidents and events reported to US-CERT during fiscal year 2010 were: (1) malicious code (software that infects an operating system or application), (2) improper usage (a violation of acceptable computing use policies), and (3) unauthorized access (where an individual gains logical or physical access to a system without permission). Additionally, according to Department of Homeland Security (DHS) officials, US-CERT detects incidents and events through its intrusion detection system, supplemented by agency reports, for investigation (unconfirmed incidents that are potentially malicious or anomalous activity deemed by the reporting entity to warrant further review). Reports of cyber attacks and information security incidents against federal systems and systems supporting critical infrastructure illustrate the effect that such incidents could have on national and economic security. In July 2010, the Department of Defense (DOD) launched an investigation to identify how thousands of classified military documents (including Afghanistan and Iraq war operations, as well as field reports on Pakistan) were obtained by the group WikiLeaks.org. According to DOD, this investigation was related to an ongoing investigation of an Army private charged with, among other things, transmitting national defense information to an unauthorized source. In 2010, the Deputy Secretary of Defense stated that DOD suffered a significant compromise of its classified military computer networks in 2008. It began when a flash drive’s malicious computer code, placed there by a foreign intelligence agency, uploaded itself onto a network and spread on both classified and unclassified systems. In February 2011, media reports stated that computer hackers broke into and stole proprietary information worth millions of dollars from the networks of six U.S. and European energy companies. The federal government has a variety of roles and responsibilities in protecting the nation’s cyber-reliant critical infrastructure, enhancing the nation’s overall cybersecurity posture, and ensuring the security of federal systems and the information they contain. In light of the pervasive and increasing threats to critical systems, the executive branch is taking a number of steps to strengthen the nation’s approach to cybersecurity. For example, in its role as the focal point for federal efforts to protect the nation’s cyber critical infrastructures, DHS issued a revised national infrastructure protection plan in 2009 and an interim national cyber incident response plan in 2010. Executive branch agencies have also made progress instituting several governmentwide initiatives that are aimed at bolstering aspects of federal cybersecurity, such as reducing the number of federal access points to the Internet, establishing security configurations for desktop computers, and enhancing situational awareness of cyber events. Despite these efforts, the federal government continues to face significant challenges in protecting the nation’s cyber- reliant critical infrastructure and federal information systems. The administration and executive branch agencies have not yet fully implemented key actions that are intended to address threats and improve the current U.S. approach to cybersecurity. Implementing actions recommended by the president’s cybersecurity policy review. In February 2009, the president initiated a review of the government’s cybersecurity policies and structures, which resulted in 24 near- and mid-term recommendations to address organizational and policy changes to improve the current U.S. approach to cybersecurity. In October 2010, we reported that 2 recommendations had been implemented and 22 were partially implemented. Officials from key agencies involved in these efforts (e.g., DHS, DOD, and the Office of Management and Budget (OMB)) stated that progress had been slower than expected because agencies lacked assigned roles and responsibilities and because several of the mid-term recommendations would require action over multiple years. We recommended that the national Cybersecurity Coordinator (whose role was established as a result of the policy review) designate roles and responsibilities for each recommendation and develop milestones and plans, including measures to show agencies’ progress and performance. Updating the national strategy for securing the information and communications infrastructure. In March 2009, we testified on the needed improvements to the nation’s cybersecurity strategy. In preparation for that testimony, we convened a panel of experts that included former federal officials, academics, and private sector executives. The panel highlighted 12 key improvements that are, in its view, essential to improving the strategy and our national cybersecurity posture, including the development of a national strategy that clearly articulates strategic objectives, goals, and priorities. Developing a comprehensive national strategy for addressing global cybersecurity and governance. In July 2010, we reported that the U.S. government faced a number of challenges in formulating and implementing a coherent approach to global aspects of cyberspace, including, among other things, providing top-level leadership and developing a comprehensive strategy. Specifically, we found that the national Cybersecurity Coordinator’s authority and capacity to effectively coordinate and forge a coherent national approach to cybersecurity were still under development. In addition, the U.S. government had not documented a clear vision of how the international efforts of federal entities, taken together, support overarching national goals. We recommended that, among other things, the national Cybersecurity Coordinator develop with other relevant entities a comprehensive U.S. global cyberspace strategy. The coordinator and his staff concurred with our recommendations and stated that actions had already been initiated to address them. Finalizing cybersecurity guidelines and monitoring compliance related to electricity grid modernization. In January 2011, we reported on efforts by the National Institute of Standards and Technology (NIST) to develop cybersecurity guidelines and Federal Energy Regulatory Commission (FERC) efforts to adopt and monitor cybersecurity standards related to the electric industry’s incorporation of IT systems to improve reliability and efficiency—commonly referred to as the smart grid. We determined that NIST had not addressed all key elements of cybersecurity in its initial guidelines or finalized plans for doing so. We also determined that FERC had not developed an approach for monitoring industry compliance with its initial set of voluntary standards. Further, we identified six key challenges with respect to securing smart grid systems, including a lack of security features being built into certain smart grid systems and an ineffective mechanism for sharing information on cybersecurity within the industry. We recommended that NIST finalize its plans for updating its cybersecurity guidelines to incorporate missing elements and that FERC develop a coordinated approach to monitor voluntary standards and address any gaps in compliance. Both agencies agreed with these recommendations. Creating a prioritized national and federal cybersecurity research and development (R&D) agenda. In June 2010, we reported that while efforts to improve cybersecurity R&D were under way by the White House’s Office Science and Technology Policy (OSTP) and other federal entities, six major challenges impeded these efforts.