T he information technology (IT) industry has evolved greatly over the last half century. Continued, exponential progress in processing power and memory capacity has made IT hardware not only faster but also smaller, lighter, cheaper, and easier to use. The original IT industry has also increasingly converged with the communications industry into a combined sector commonly called information and communications technology (ICT). This technology is ubiquitous and increasingly integral to almost every facet of modern society. ICT devices and components are generally interdependent, and disruption of one may affect many others. Over the past several years, experts and policymakers have expressed increasing concerns about protecting ICT systems from cyberattacks —deliberate attempts by unauthorized persons to access ICT systems, usually with the goal of theft, disruption, damage, or other unlawful actions. Many experts expect the number and severity of cyberattacks to increase over the next several years. The act of protecting ICT systems and their contents has come to be known as cybersecurity . A broad and arguably somewhat fuzzy concept, cybersecurity can be a useful term but tends to defy precise definition. It usually refers to one or more of three things: A set of activities and other measures intended to protect—from attack, disruption, or other threats—computers, computer networks, related hardware and devices, software, and the information they contain and communicate, including software and data, as well as other elements of cyberspace. The state or quality of being protected from such threats. The broad field of endeavor aimed at implementing and improving those activities and quality. It is related to but not generally regarded as identical to the concept of information security , which is defined in federal law (44 U.S.C. §3552(b)(3)) as protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide- (A) integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity; (B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and (C) availability, which means ensuring timely and reliable access to and use of information. Cybersecurity is also sometimes conflated inappropriately in public discussion with other concepts such as privacy, information sharing, intelligence gathering, and surveillance. Privacy is associated with the ability of an individual person to control access by others to information about that person. Thus, good cybersecurity can help protect privacy in an electronic environment, but information that is shared to assist in cybersecurity efforts might sometimes contain personal information that at least some observers would regard as private. Cybersecurity can be a means of protecting against undesired surveillance of and gathering of intelligence from an information system. However, when aimed at potential sources of cyberattacks, such activities can also be useful to help effect cybersecurity. In addition, surveillance in the form of monitoring of information flow within a system can be an important component of cybersecurity. The risks associated with any attack depend on three factors: threats (who is attacking), vulnerabilities (the weaknesses they are attacking), and impacts (what the attack does). The management of risk to information systems is considered fundamental to effective cybersecurity. People who actually or potentially perform cyberattacks are widely cited as falling into one or more of five categories: criminals intent on monetary gain from crimes such as theft or extortion; spies intent on stealing classified or proprietary information used by government or private entities; nation-state warriors who develop capabilities and undertake cyberattacks in support of a country's strategic objectives; " hacktivists " who perform cyberattacks for nonmonetary reasons; and terrorists who engage in cyberattacks as a form of non-state or state-sponsored warfare. Cybersecurity is in many ways an arms race between attackers and defenders. ICT systems are very complex, and attackers are constantly probing for weaknesses, which can occur at many points. Defenders can often protect against weaknesses, but three are particularly challenging: inadvertent or intentional acts by insiders with access to a system; supply chain vulnerabilities, which can permit the insertion of malicious software or hardware during the acquisition process; and previously unknown, or zero-day , vulnerabilities with no established fix. Even for vulnerabilities where remedies are known, they may not be implemented in many cases because of budgetary or operational constraints. A successful attack can compromise the confidentiality, integrity, and availability of an ICT system and the information it handles. Cybertheft or cyberespionage can result in exfiltration of financial, proprietary, or personal information from which the attacker can benefit, often without the knowledge of the victim. Denial-of-service attacks can slow or prevent legitimate users from accessing a system. Botnet malware can give an attacker command of a system for use in cyberattacks on other systems. Attacks on industrial control systems can result in the destruction or disruption of the equipment they control, such as generators, pumps, and centrifuges. Most cyberattacks have limited impacts, but a successful attack on some components of critical infrastructure (CI)—most of which is held by the private sector—could have significant effects on national security, the economy, and the livelihood and safety of individual citizens. Thus, a rare successful attack with high impact can pose a larger risk than a common successful attack with low impact. While it is widely recognized that cyberattacks can be costly to individuals and organizations, economic impacts can be difficult to measure, and estimates of those impacts vary widely. An often cited figure for annual cost to the global economy from cybercrime is $400 billion, with some observers arguing that costs are increasing substantially, especially with the continued expansion of ICT infrastructure through the Internet of Things and other new and emerging platforms. The costs of cyberespionage can be even more difficult to quantify but are considered to be substantial. Managing the risks from cyberattacks usually involves (1) removing the threat source (e.g., by closing down botnets or reducing incentives for cybercriminals); (2) addressing vulnerabilities by hardening ICT assets (e.g., by patching software and training employees); and (3) lessening impacts by mitigating damage and restoring functions (e.g., by having back-up resources available for continuity of operations in response to an attack). The optimal level of risk reduction will vary among sectors and organizations. For example, the level of cybersecurity that customers expect may be lower for a company in the entertainment sector than for a bank, a hospital, or a government agency. The federal role in cybersecurity involves both securing federal systems and assisting in protecting nonfederal systems. Under current law, all federal agencies have cybersecurity responsibilities relating to their own systems, and many have sector-specific responsibilities for CI. More than 50 statutes address various aspects of cybersecurity. Figure 1 is a simplified schematic diagram of major agency responsibilities in cybersecurity. In general, the National Institute of Standards and Technology (NIST) develops standards that apply to federal civilian ICT under the Federal Information Security Modernization Act (FISMA), and the Office of Management and Budget (OMB) is responsible for overseeing their implementation. The Department of Defense (DOD) is responsible for military ICT, defense of the nation in cyberspace, and, through the National Security Agency (NSA), security of national security systems (NSS), which handle classified information. NSA is also part of the Intelligence Community (IC). The Department of Homeland Security (DHS) has operational responsibility for protection of federal civilian systems and is the lead agency coordinating federal efforts assisting the private sector in protecting CI assets. It is also the main federal focus of information sharing for civilian systems through its National Cybersecurity and Communications Integration Center (NCCIC). The Department of Justice (DOJ) is the lead agency for enforcement of relevant laws. In February 2015, the Obama Administration also established, via presidential memorandum, the Cyber Threat Intelligence Integration Center (CTIIC) under the Director of National Intelligence (DNI). Its purposes are to provide integrated analysis on cybersecurity threats and incidents affecting national interests across the federal government and to support relevant government entities, including the NCCIC and others at DOD and DOJ. Federal agencies spend a significant part of their annual IT funding on cybersecurity, which currently constitutes 16-17% (about one in every seven dollars) of agency IT budgets overall ( Table 1 ). However, DOD spending accounts for a large proportion of that expenditure, ranging from 22% to 30% of the DOD IT budget from FY2010 to FY2015. The median proportion for other agencies has been 6%-7% during that period. That is roughly equivalent to spending patterns for businesses of 4%-9% reported in a recent survey. The FY2017 budget request includes over $19 billion altogether for cybersecurity. With a total requested IT investment of $81.6 billion, that would amount to a proportion of 23.3%, or about one in every four dollars, to be spent on cybersecurity. For more information on federal cybersecurity spending, see CRS Report R44404, Perspectives on Federal Cybersecurity Spending , by [author name scrubbed] and [author name scrubbed]. Since at least the 111 th Congress, many bills have been introduced that would address a range of cybersecurity issues: Cybercrime Laws —updating criminal statutes and law-enforcement authorities relating to cybersecurity. Data-Breach Notification —requiring notification to victims and other responses after data breaches involving personal or financial information of individuals. FISMA Reform —updating the law to reflect changes in ICT and the threat landscape. Information Sharing —easing access of the private sector to classified and unclassified threat information and removing barriers to sharing within the private sector and with the federal government.