Critical Infrastructure Protection: Additional Actions Needed to Identify Framework Adoption and Resulting Improvements

Cyber threats to the nation's critical infrastructure (e.g., financial services and energy sectors) continue to increase and represent a significant national security challenge. To better address such threats, NIST developed, as called for by federal law, a voluntary framework of cybersecurity standards and procedures.

The Cybersecurity Enhancement Act of 2014 included provisions for GAO to review aspects of the framework. The objectives of this review were to determine the extent to which (1) SSAs have developed methods to determine framework adoption and (2) implementation of the framework has led to improvements in the protection of critical infrastructure from cyber threats. GAO analyzed documentation, such as implementation guidance, plans, and survey instruments. GAO also conducted semi-structured interviews with 12 organizations, representing six infrastructure sectors, to understand the level of framework use and related improvements and challenges. GAO also interviewed agency and private sector officials.

Most of the nine agencies with a lead role in protecting the 16 critical infrastructure sectors, as established by federal policy and referred to as sector-specific agencies (SSAs), have not developed methods to determine the level and type of adoption of the National Institute of Standards and Technology's (NIST) Framework for Improving Critical Infrastructure Cybersecurity (framework), as GAO previously recommended. Specifically, two of the nine SSAs had developed methods and two others had begun taking steps to do so. The remaining five SSAs did not yet have methods to determine framework adoption. Most of the sectors (13 of 16), however, noted that they had taken steps to encourage and facilitate use of the framework, such as developing implementation guidance that links existing sector cybersecurity tools, standards, and approaches to the framework. In addition, all of the 12 selected organizations that GAO interviewed described either fully or partially using the framework. Nevertheless, implementing GAO's recommendations to the SSAs to determine the level and type of adoption remains essential to the success of protection efforts.

The 12 selected organizations using the framework reported varying levels of resulting improvements. Such improvements included identifying risks and implementing common standards and guidelines. However, the SSAs have not collected and reported sector-wide improvements. The SSAs and organizations identified impediments to doing so, including the (1) lack of precise measurements of improvement, (2) lack of a centralized information sharing mechanism, and (3) voluntary nature of the framework. NIST and the Department of Homeland Security (DHS) have initiatives to help address these impediments.

Precise measurements: NIST is in the process of developing an information security measurement program that aims to provide the tools and guidance to support the development of information security measures that are aligned with an individual organization's objectives. However, NIST has not established a time frame for the completion of the measurement program.

Centralized sharing: DHS identified its homeland security information network as a tool that was intended to be the primary system that could be used by all sectors to report on best practices, including sector-wide improvements and lessons learned from using the framework.

Voluntary nature: In April 2019, NIST issued its NIST Roadmap for Improving Critical Infrastructure Cybersecurity , version 1.1, which included a tool for organizations to self-assess how effectively they manage cybersecurity risks and identify improvement opportunities.

While these initiatives are encouraging, the SSAs have not yet reported on sector-wide improvements. Until they do so, the extent to which the 16 critical infrastructure sectors are better protecting their critical infrastructures from threats will be largely unknown.

GAO is making ten recommendations—one to NIST on establishing time frames for completing selected programs—and nine to the SSAs to collect and report on improvements gained from using the framework. Eight agencies agreed with the recommendations, while one neither agreed nor disagreed and one partially agreed. GAO continues to believe that all ten recommendations are warranted.

The nation’s critical infrastructure provides the essential services—such  as banking, water, and electricity— that underpin American society. The  infrastructure relies on electronic systems and data to support its  missions. However, cyber threats to the critical infrastructure continue to  increase and represent a significant national security challenge. In this  regard, malicious actors have intruded and extracted highly sensitive  materials from the networks of a number of government agencies and  major critical infrastructure companies.

To address the cyber-based threats to the critical infrastructure, the  President issued Executive Order 13636, Improving Critical Infrastructure  Cybersecurity, in February 2013. This order aimed to enhance the  security and resilience of the nation’s critical infrastructure and maintain a  cyber environment that encourages efficiency, innovation, and economic  prosperity while promoting safety, security, business confidentiality,  privacy, and civil liberties.

Among other things, the order called for the Director of the National  Institute of Standards and Technology (NIST) to lead the development of  a voluntary, consensus-based cybersecurity framework that would  comprise a set of industry standards and best practices to help  organizations manage cybersecurity risks. In response, NIST issued the  Framework for Improving Critical Infrastructure Cybersecurity (the  framework) in February 2014 to provide private sector organizations with  principles and best practices of risk management to improve the security  and resilience of their critical infrastructures. In addition, the  Cybersecurity Enhancement Act of 2014 (Cybersecurity Act) authorized  NIST, among other things, to facilitate and support the development of a  voluntary set of standards, best practices, and procedures to reduce  cyber risks to critical infrastructures on an ongoing basis.

The Cybersecurity Act also included a provision for us to review, in a  series of reports, various aspects of the framework. The objectives of this  review were to determine the extent to which (1) agencies with a lead role  in critical infrastructure protection efforts, referred to as sector-specific  agencies (SSA), have developed methods to determine the level and type  of framework adoption and (2) implementation of the framework has led  to improvements in the protection of critical infrastructure from cyber  threats.

To address the first objective, we analyzed documentation, such as  implementation guidance and survey instruments on framework adoption,  that discussed actions federal and nonfederal entities have taken since our report in 2018 to determine the level and type of adoption across their  sectors. These entities included SSAs, NIST, Sector Coordinating  Councils (SCC), which are made up of nonfederal organizations and  serve as the voice of each sector and principal entryway for the  government to collaborate with each sector, and Information Sharing and  Analysis Centers (ISAC). We included SSAs and SCCs representing all  of the 16 critical infrastructure sectors in our review. We also analyzed  documentation from NIST and the Department of Homeland Security  (DHS) and interviewed officials from entities–including SSAs, SCCs,  NIST, and DHS–regarding their activities to assess the level and type of  framework adoption by the entities within each sector.

In addition, we selected six critical infrastructure sectors identified in the  2018 National Cyber Strategy of the United States of America as having  critical infrastructure with the greatest risk of being compromised. From  these sectors, we asked SCCs, trade associations (e.g., the American  Petroleum Institute), and ISACs to provide a list of small or medium and  large organizations that were users of the framework. We then divided up  the list of identified organizations by sector, and we randomly selected  one large and one small or medium organization from each sector,  resulting in a final list of 12 organizations. We conducted semi-structured  interviews with officials from the selected organizations to understand the  extent to which these organizations were using the framework.

To address the second objective, we collected and reviewed  documentation, such as survey instruments and guides from federal and  nonfederal entities (NIST, SSAs, SCCs, and ISACs) that discussed their  efforts to measure sector-wide improvements. We compared these efforts  to best practices, such as NIST Special Publication 800-55, to identify any  measures the SSAs and SCCs had established to determine  improvements as a result of using the framework. In addition, we  interviewed officials from the selected organizations to understand the  extent to which they realized improvements in cybersecurity as a result of  framework adoption. We also interviewed officials from NIST, SSAs,  SCCs, and the selected organizations regarding the challenges in  measuring improvements and any steps taken to address those  challenges. Appendix I discusses our objectives, scope, and methodology  in greater detail.

We conducted this performance audit from January 2019 to February  2020 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit  to obtain sufficient, appropriate evidence to provide a reasonable basis  for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.

Our nation’s critical infrastructure refers to the systems and assets,  whether physical or virtual, so vital to the United States that the incapacity  or destruction of them would have a debilitating impact on our security,  economic stability, public health or safety, or any combination of these  factors. Critical infrastructure includes, among other things, banking and  financial institutions, telecommunications networks, and energy  production and transmission facilities, most of which are owned and  operated by the private sector.

Threats to the systems supporting our nation’s critical infrastructures are  evolving and growing. These systems are susceptible to unintentional and  intentional threats, both cyber and physical. Unintentional, or  nonadversarial, threat sources include equipment failures, software  coding errors, or the accidental actions of employees. They also include  natural disasters and the failure of other critical infrastructures, since the  sectors are often interdependent.

Intentional or adversarial threats can involve targeted and untargeted  attacks from a variety of sources, including criminal groups, hackers, and  disgruntled employees. Adversaries can leverage common computer  software programs to deliver a threat by embedding exploits within  software files that can be activated when a user opens a file within its  corresponding program.

Due to the cyber-based threats to federal systems and critical  infrastructure, the persistent nature of information security vulnerabilities,  and the associated risks, GAO first designated federal information  security as a government-wide high-risk area in our biennial report to  Congress in 1997. In 2003, we expanded this high-risk area to include the  protection of critical cyber infrastructure and, in 2015, we further  expanded this area to include protecting the privacy of personally  identifiable information. We continue to identify the protection of critical  cyber infrastructure as a high-risk area, as shown in our March 2019 high- risk update.

Federal Law and Policy Assign Responsibilities for the Protection of Critical Infrastructure Sectors

Because the private sector owns the majority of the nation’s critical  infrastructure, it is vital that the public and private sectors work together to  protect these assets and systems. Toward this end, federal law and policy  assign roles and responsibilities for agencies to assist the private sector  in protecting critical infrastructure, including enhancing cybersecurity.

Presidential Policy Directive 21 establishes the SSAs in the public sector  as the federal entities responsible for providing institutional knowledge  and specialized expertise. The SSAs lead, facilitate, and support the  security and resilience programs and associated activities of their  designated critical infrastructure sectors.

The directive identified 16 critical infrastructure sectors and designated  the nine associated SSAs, as shown in figure 1.

In addition, the directive required DHS to update the National  Infrastructure Protection Plan to address the implementation of the  directive. The directive called for the plan to include, among other  things, the identification of a risk management framework to be used to  strengthen the security and resilience of critical infrastructure and a  metrics and analysis process to be used to measure the nation’s ability to  manage and reduce risks to critical infrastructure. DHS, in response,  updated the National Infrastructure Protection Plan in December 2013 in  collaboration with public- and private-sector owners and operators and  federal and nonfederal government representatives, including SSAs, from  the critical infrastructure community. According to the 2013 plan, SSAs  are to work with their private-sector counterparts to understand cyber risk  and they are to develop and use metrics to evaluate the effectiveness of  risk management efforts.

To work with the government, the SCCs were formed as self-organized,  self-governing councils that enable critical infrastructure owners and  operators, their trade associations, and other industry representatives to  interact on a wide range of sector-specific strategies, policies, and  activities. The SSAs and the SCCs coordinate and collaborate in a  voluntary fashion on issues pertaining to their respective critical  infrastructure sector.

In addition to the directive, federal laws and policies have also  established roles and responsibilities for federal agencies to work with  industry to enhance the cybersecurity of the nation’s critical  infrastructures. These include the Cybersecurity Enhancement Act of  2014 and Executive Order 13636.

In February 2013, Executive Order 13636 outlined an action plan for  improving critical infrastructure cybersecurity. Among other things, the  executive order directed NIST to lead the development of a flexible  performance-based cybersecurity framework that was to include a set of  standards, procedures, and processes. The executive order also directed  SSAs, in consultation with DHS and other interested agencies, to  coordinate with the SCCs to review the cybersecurity framework and, if  necessary, develop implementation guidance or supplemental materials  to address sector-specific risks and operating environments.

Further, in December 2014, the Cybersecurity Enhancement Act of 2014  established requirements that are consistent with the executive order  regarding NIST’s development of a cybersecurity framework. According to  this law, NIST’s responsibilities in supporting the ongoing development of  the cybersecurity framework included, among other things, identifying an  approach that is flexible, repeatable, performance-based, and cost- effective. Additionally, the Cybersecurity Act requires NIST to coordinate  with federal and nonfederal entities (e.g., SSAs, SCCs, and ISACs) to  identify a prioritized, performance-based approach to include information  security measures to help entities assess risk.

In May 2017, Executive Order 13800 directed federal agency heads to  use the framework to manage cybersecurity risks. The executive order  also required them to provide a risk management report to DHS and the  Office of Management and Budget within 90 days of the date of the  executive order. The risk management report calls for agencies to  document the risk mitigation and acceptance choices including, for  example, describing the agency’s action plan to implement the  framework.

NIST Established a Framework for Improving Critical Infrastructure Cybersecurity

In response to Executive Order 13636, NIST published, in February 2014,  the Framework for Improving Critical Infrastructure Cybersecurity, a  voluntary framework of cybersecurity standards and procedures for  industry to adopt. According to NIST, as of February 2019, the framework  had been downloaded more than a half million times since its initial  publication in 2014. Additionally, it has been translated into Arabic,  Japanese, Portuguese, and Spanish, and has been adopted by many  foreign governments. The framework is composed of three main  components: the framework core, the implementation tiers, and the  profiles.

The framework core provides a set of activities to achieve specific  cybersecurity outcomes and references examples of guidance to achieve  those outcomes. Through the use of the profile, the framework is intended  to help organizations align their cybersecurity activities with business  requirements, risk tolerances, and resources.

The framework core is divided into four elements: functions, categories,  subcategories, and informative references. Functions consist of five  elements—(1) identify, (2) protect, (3) detect, (4) respond, and (5)  recover. When considered together, these functions provide a strategic  view of the life cycle of an organization’s management of cybersecurity  risk. Categories are the subdivisions of a function into groups of  cybersecurity outcomes tied to programmatic needs and particular  activities (i.e. asset management). Subcategories further divide a  category into specific outcomes of technical and/or management activities  (i.e. notifications from detection systems are investigated). Lastly,  informative references are specific sections of standards, guidelines, and  practices that illustrate a method to achieve the outcomes described and  support one or more informative references (i.e. NIST Special Publication  (SP) 800-53A).

Implementation tiers characterize an organization’s approach to  managing cybersecurity risks over a range of four tiers. The four tiers are  partial, risk informed, repeatable, and adaptive. They reflect a progression  from informal, reactive responses to approaches that are flexible and risk- informed.

Profiles enable organizations to establish a road map for reducing  cybersecurity risks that is well aligned with organizational and sector  goals, consider legal/regulatory requirements and industry best practices,  and reflect risk management priorities. Organizations can use the  framework profiles to describe the current state (the cybersecurity  outcomes that are currently being achieved) or the desired target state  (the outcomes needed to achieve the desired cybersecurity risk  management goals) of specific cybersecurity activities.

GAO Has Previously Reported on the Development, Promotion, and Adoption of the Cybersecurity Framework

In December 2015, we issued our first report on the development and  promotion of the framework in response to the 2014 Cybersecurity Act.  We reported that the framework met the requirements established in  federal law that it be flexible, repeatable, performance-based, and cost- effective. We also reported that SSAs and NIST had promoted and  supported adoption of the cybersecurity framework in the critical  infrastructure sectors. For example, we reported that DHS had  established the Critical Infrastructure Cyber Community Voluntary  Program to encourage adoption of the framework and had undertaken  multiple efforts as part of this program. These efforts included developing  guidance and tools intended to help sector entities that use the  framework. However, we noted that DHS had not developed metrics to  measure the success of its activities and programs. Accordingly, we  concluded that DHS could not determine if its efforts were effective in  encouraging adoption of the framework. We recommended that the  department develop metrics to assess the effectiveness of its framework  promotion efforts. DHS agreed with the recommendation and  subsequently took actions to implement it.

We also reported in December 2015 that SSAs had promoted the  framework in their sectors by, for example, presenting the framework at  meetings of sector stakeholders and holding other promotional events. In  addition, all of the SSAs, except for DHS and the General Services  Administration (GSA), as co-SSAs for the government facilities sector,  made decisions, as required by Executive Order 13636, on whether to  develop tailored framework implementation guidance for their sectors.

However, we noted that DHS and GSA had not set a time frame to  determine, as required by Executive Order 13636, whether sector-specific  implementation guidance was needed for the government facilities sector.  We concluded that, by not doing so, DHS and GSA could be hindering  the adoption of the framework in this sector. As a result, we  recommended that DHS and GSA set a time frame to determine whether  implementation guidance was needed for the government facilities sector.  Both DHS and GSA agreed with our recommendations and subsequently  took actions to implement them.

More recently, in February 2018, we issued our second report on the  adoption of the framework. We reported that most of the 16 critical  infrastructure sectors had taken action to facilitate adoption of the  framework by entities within their sectors. We also reported that 12 of  the 16 critical infrastructure sectors had taken actions to review the  framework and, if necessary, develop implementation guidance or  supplemental materials that addressed how entities within their respective  sectors can adopt the framework.

We also reported that none of the SSAs had measured the cybersecurity  framework’s implementation by entities within their 16 respective sectors.  We noted that the nation’s plan for national critical infrastructure  protection efforts stated that federal and nonfederal sector partners  (including SSAs) were to measure the effectiveness of risk management  goals by identifying high-level outcomes and progress made toward  national goals and priorities, including securing critical infrastructure  against cyber threats. However, we reported that none of the 16  coordinating councils reported having qualitative or quantitative measures  of framework adoption because they generally did not collect specific  information from entities about critical infrastructure protection activities.

Most SSAs Have Not Developed Methods to Determine Framework Adoption

As of November 2019, most of the SSAs had not developed methods to  determine their level and type of cybersecurity framework adoption, as we  previously recommended. The SSAs and SCCs identified a number of  impediments to developing a comprehensive understanding of the use of  the framework, including the voluntary nature of the framework. However,  most SSAs have taken steps to encourage and facilitate use of the  framework. Further, the 12 selected organizations we interviewed  reported either fully or partially using the cybersecurity framework.

Most Sector-Specific Agencies Had Not Determined the Level and Type of Framework Adoption

Best practices identified in the National Infrastructure Protection Plan  recommend that entities, such as SSAs and SCCs, take steps to evaluate  progress toward achieving their goals—in this case, to implement or  adopt the cybersecurity framework. As we previously reported, until the  SSAs had a more comprehensive understanding of the use of the  cybersecurity framework by entities within the critical infrastructure  sectors, they would be limited in their ability to understand the success of  protection efforts or to determine where to focus limited resources for  cyber risk mitigation. As a result, we recommended that the SSAs take  steps to consult with respective sector partner(s), such as the SCCs,  DHS, and NIST, as appropriate, to develop methods for determining the  level and type of framework adoption by the entities across their  respective sectors.

However, as of November 2019, most of the SSAs had not developed  methods to determine the level and type of framework adoption.  Specifically, only two of the nine SSAs—the Department of Defense  (DOD) in collaboration with the defense industrial base sector and GSA in  conjunction with DHS’s Federal Protective Service—had methods to  determine the level and type of framework adoption across their  respective sectors.

DOD, in coordination with the defense industrial base sector, had  developed a process to monitor the level or extent to which all contracts  (not including commercial off-the-shelf contracts) were or were not  adhering to the cybersecurity requirements in DOD acquisition  regulations. The regulations called for organizations to implement the  security requirements in NIST SP 800-171, which is mapped to the  functional areas of the cybersecurity framework. By doing so, DOD is  able to determine the level at which the sector organizations are  implementing the framework and the type of framework adoption through  mapping to the functional areas.

Additionally, the federal departments and agencies that form the  government facilities sector had submitted their risk management reports  to DHS and OMB that described agencies’ action plans to implement the  framework, as required under Executive Order 13800. The risk  management assessments are included as part of OMB’s FISMA Annual  Report to Congress. As a result, the reports could be used as a  resource to inform the level and type of framework adoption.

In addition, two other SSAs had begun taking steps to develop methods  to determine the level and type of framework adoption in their sectors.  Specifically, in October 2019, DHS, in coordination with its information  technology (IT) sector partner, administered a survey to all small and  midsized IT sector organizations to gather information on, among other  things, framework use and plans to report on the results in 2020. Further,  officials in the Department of Transportation’s (DOT) Office of  Intelligence, Security, and Emergency Response, in coordination with its  co-SSA (DHS), told us that they planned to develop and distribute a  survey to the transportation systems sector to determine the level and  type of framework adoption. DOT officials stated that the draft survey was  undergoing DHS legal review and that the completion of the review and  subsequent OMB review would determine when the survey is approved  for distribution.

The remaining five SSAs did not have efforts underway to determine the  level and type of framework adoption: Department of Agriculture,  Department of Energy, Department of Health and Human Services  (HHS), Environmental Protection Agency (EPA), and Department of the  Treasury. These SSAs identified impediments to determining framework  adoption but also noted steps taken to encourage use of the framework  within their respective sector.

Department of Agriculture’s Office of Homeland Security officials  stated that their sector is diverse and includes over 500 sector  members that can range from small farms that are family operated to  large corporations that deal with selling food wholesale. The officials  noted that the diversity makes it difficult to develop a method for  determining the level and type of framework adoption across the  sector that would apply to all their members.

The framework, however, is adaptive to provide a flexible and risk- based implementation. Accordingly, the framework can be used with a  broad array of cybersecurity risk management processes. Agriculture  officials added that the SCC frequently invites DHS to semi-annual  meetings to present on both the threat to cybersecurity and resources  available to support the needs of the sector.

Department of Energy’s Office of Cybersecurity, Energy Security, and  Emergency Response officials stated that the voluntary nature of the  framework made it difficult to determine the level and type of  framework adoption.

However, the department published the Cybersecurity Capability  Maturity Model in May 2012, with the most recent update (version 1.1)  published in February 2014. The model focused on the  implementation and management of cybersecurity practices, and was  intended to be descriptive, rather than prescriptive, guidance that  could be used by organizations of various types and sizes to  strengthen their cybersecurity capabilities. The model was designed  for organizations to use with a self-evaluation methodology and toolkit  to measure and improve their cybersecurity programs and serve as an  example for how to implement the framework. In February 2020,  officials stated that they were in the process of updating the model  and will update the framework implementation guidance once the  model has been updated.

HHS’s Assistant Secretary for Preparedness and Response (ASPR)  officials stated that, since the use of the framework by the private  sector is voluntary, organizations were free to choose any  cybersecurity framework(s) that they believed to be most effective for  their particular environment.

However, HHS, in collaboration with NIST, DHS, and the Joint  Healthcare and Public Health Cybersecurity Working Group, released  a cybersecurity publication (Health Industry Cybersecurity Practices:  Managing Threats and Protecting Patients) that contained 10 best  practices in December 2018  for the healthcare and public health  services sector based on the framework. This publication allowed  stakeholders to identify how to use the framework with existing sector  resources by raising awareness and providing vetted cybersecurity  practices to enable the organizations to mitigate cybersecurity threats  to the sector. In addition, officials from HHS’s ASPR stated that the  working group discussed the challenges associated with measuring  the use and impact of the NIST framework, and approved the  establishment of a task group in 2020 to further investigate the issue.  ASPR officials added that some of the ideas discussed included the  use of surveys and identification of a set of voluntary reporting  indicators.

EPA officials told us that the agency will coordinate with its SCC to  identify appropriate means to collect and report information, such as a  survey, to determine the level and type of framework adoption. They  explained that, in the past, the water sector had expressed concerns  with sharing sensitive cybersecurity information and in developing  metrics to evaluate cybersecurity practices.

However, EPA officials stated that they have conducted training,  webcasts, and outreach related to cybersecurity, including using the  framework and tailoring its efforts to sector needs. According to EPA  officials, the agency’s goal in doing so was to ensure that sector  organizations understood the importance of the framework.

Department of the Treasury officials noted the size of the financial  services sector as an impediment to determine framework adoption.  Specifically, officials stated that, because of the large number of  members, it is difficult to survey all 800,000 organizations to  determine framework adoption.

However, officials stated that the department, in coordination with the  Financial and Banking Information Infrastructure Committee, and in  consultation with NIST, developed the Cybersecurity Lexicon in March  2018. The lexicon addressed, among other things, common  terminology for cyber terms used in the framework. Additionally, the  financial services sector, in consultation with NIST, created the  Financial Services Sector Cybersecurity Profile (profile) in October  2018, which mapped the framework core to existing regulations and  guidance, such as the Commodity Futures Trading Commission  System Safeguards Testing Requirements. Officials stated that  these efforts will facilitate the use of the framework.

While the five SSAs have ongoing initiatives, implementing our  recommendations to gain a more comprehensive understanding of the  framework’s use by critical infrastructure sectors is essential to the  success of protection efforts.

Most SSAs Have Taken Steps to Facilitate Use of the Framework

Executive Order 13636 directs SSAs, in consultation with DHS and other  agencies, to review the cybersecurity framework and, if necessary,  develop implementation guidance or supplemental materials to address  sector-specific risks and facilitate framework use. Most of the SSAs  developed guidance to encourage and facilitate use of the framework.  Specifically, SSAs for 13 of the 16 sectors had developed implementation  guidance that included mapping the existing sector cybersecurity tools,  standards, and approaches to the framework. For example, the  implementation guidance for the healthcare and public health sector  provides instruction on how to align a host of existing voluntary or  required standards (such as those promulgated pursuant to the Health  Insurance Portability and Accountability Act of 1996), guidelines, and  practices to the framework core functions.

Table 1 describes the 13 sectors and the associated cybersecurity  framework implementation guidance.

The Cybersecurity Capability Maturity Model helps organizations evaluate  and potentially improve their cybersecurity practices. Appendix A of the  Energy Sector Cybersecurity Framework Implementation Guidance  provides a mapping of the model to the framework.

The Financial Services Sector Cybersecurity Profile was created for  financial institutions of all sizes to use for cyber risk management  assessment and a mechanism to comply with various regulatory  frameworks and the NIST Cybersecurity Framework.

The remaining three sectors (government facilities, food and agriculture,  and IT) had not developed implementation guidance. In this regard,  DHS’s Federal Protective Service officials stated that, in 2015, the co- SSAs of the government facilities sector (DHS and GSA) decided that  implementation guidance was not needed based on a consensus within  the government facilities sector. DHS’s Federal Protective Service  officials added that this decision was reevaluated in 2017 and they  determined that the guide was still not needed.

Department of Agriculture officials from the Office of Homeland Security  stated that the co-SSAs (Agriculture and HHS) and the SCC for the sector  collectively decided that a single implementation guidance document was  not sufficient for addressing the needs of the diverse membership of the  food and agriculture sector and that the creation of such a document was  a low priority for the sector. These officials added that, due to the  complexity of operations and large number of entities within the sector,  the coordinating councils determined that it was more appropriate to refer  sector members to DHS's Critical Infrastructure Cyber Community  Voluntary Program.

DHS officials representing the SSA for the IT sector stated that the SSA  and SCC jointly determined that creating formal implementation guidance  within the sector was not necessary. They added that the IT sector  continued to play an active role by participating in framework  development and promotion across the sectors, to include the  development of a small and midsize business cybersecurity survey that  was issued in 2019.

In addition to the above efforts, NIST officials stated that they took steps  to encourage framework adoption through three main mechanisms for  federal and nonfederal entities and organizations that were interested in  the framework: (1) conferences and speaking engagements, (2) requests  for information to solicit ways in which organizations are using the  framework to improve cybersecurity risk management and how best  practices are being shared, and (3) industry and agency events, such as  webcasts.

Selected Organizations Described Varying Levels of Use of the Framework

The 12 selected organizations reported either fully or partially using the  cybersecurity framework. Specifically, six organizations reported fully  using the framework, whereas six others reported partially using the  framework. For example, one organization that reported fully using the  framework stated that the framework core, profiles, and tiers were  implemented across all the components or business units in the  organization. In contrast, one organization that reported partially using the  framework stated that it used the framework profiles, but did not fully use  the framework core and tiers. Two other of the organizations that reported  partially using the framework stated that they considered themselves to  be using the framework since they use International Organization for  Standardization (ISO) 27001, an international standard that has elements  that overlap with those in the framework.

Selected Organizations Reported Improvements but SSAs Have Not Collected and Reported Sector- Wide Improvements Resulting from Framework Use

The 12 selected organizations using the framework reported varying  levels of improvements. Such improvements included identifying risks and  implementing common standards and guidelines. However, the SSAs  have not collected and reported sector-wide improvements as a result of  framework use. The SSAs, SCCs, ISACs, and the selected organizations  identified impediments to collecting and reporting such improvements,  including developing precise measurements of improvement, the  voluntary nature of the framework, and lack of a centralized information  sharing mechanism. NIST and DHS have identified initiatives to help  address these impediments.

Selected Organizations Described Varying Levels of Improvements from Using the Framework

The 12 selected organizations reported varying levels of improvements as  a result of using the framework. Specifically, four of the 12 reported great  improvement, six reported some improvement, and two reported little  improvement. Examples of each category are described below:

Great improvement: One organization stated that the framework  allowed it to determine the current state (the cybersecurity outcomes  that are currently being achieved) and the desired target state (the  outcomes needed to achieve the desired cybersecurity risk  management goals). The organization stated that identifying the  current and target states enabled the organization to identify risks and  implement common policies, standards, and guidelines across their  organization. Officials of the organization also stated that the common  language provided by the framework made it easier to communicate  within the organization when discussing budgets for cybersecurity that  resulted in budget increases.

Some improvement: One organization explained that the framework is  accepted across organizations and that modeling its capabilities  against the framework provided assurance that it covered the critical  aspects of security. However, the organization noted that, if the  framework did not exist, it would have used another framework to  protect its critical infrastructure and facilitate decision making.

Little improvement: One organization noted that it already had a very  robust risk management process through the use of international  standards before using the framework. As a result, the organization  stated that use of the framework resulted in little improvements.  Another organization that reported little improvements stated that use  of the framework helped the organization, but there were no specific  improvements that it could identify in protecting its critical  infrastructure as a result of using the framework.

Initiatives Available to Help Address Impediments to Collecting and Reporting on Sector-Wide Improvements

NIST Special Publication 800-55 guidance on performance measurement  states that agency heads are responsible for actively demonstrating  support for developing information security measures and facilitating  performance improvements in their information security programs, which  is to include a periodic analysis of data to determine lessons learned.  Additionally, the National Infrastructure Protection Plan directed SSAs  and their federal and nonfederal sector partners (including SCCs) to  measure the effectiveness of risk management goals by identifying high- level outcomes to facilitate the evaluation of progress toward national  goals and priorities, including securing critical infrastructure from  cybersecurity threats.

The SSAs are not collecting and reporting on improvements in the  protection of critical infrastructure as a result of using the framework  across the sectors. The SSAs, SCCs, ISACs, and organizations reported  a number of impediments to identifying sector-wide improvements,  including developing precise measurements of improvement, the  voluntary nature of the framework, difficulty in measuring the direct impact  of using the framework, lack of use cases, and lack of a centralized  information sharing mechanism. Figure 2 depicts the number of entities  and organizations that identified these five impediments, and is followed  by a discussion of each challenge.

Two SCCs, two ISACs, and two organizations identified the difficulty  of having precise measurements of improvements as a result of using  the framework. SCC officials from the communications and healthcare  and public health sectors stated that authoritative and precise  measurements of improvements are difficult to determine in a  consistent and non-subjective manner. For example, the SCC officials  for the healthcare and public health sector stated that they were not  aware of a direct or precise form of sector-wide measurements to  define success in mitigating cybersecurity risk using the framework  within the sector. These officials added that future efforts could  include methodologies to track sector-wide improvements based on  the framework structure or other cybersecurity guidance.

However, officials from NIST’s Information Technology Laboratory  stated that they were in the early stages of initiating an information  security measurement program to facilitate identifying improvements  sector-wide. Officials stated that the program aims to provide  foundation tools and guidance to support the development of  information security measures that are aligned with an individual  organization’s objectives. The officials stated that they had not  established a time frame for the completion of the measurement  program. They added that, once the program is developed, the SSAs  are expected to be able to customize the program and work with their  respective sector organizations to determine sector-wide  improvements based on their unique objectives.

Eight SSAs, two SCCs, and four organizations stated that the  voluntary nature of using the framework made it difficult to identify  sector-wide improvements. Officials stated that private sector  framework adoption was voluntary and, therefore, there were no  specific reporting requirements to provide information on  improvements. For example, DOT officials from the Office of  Intelligence, Security, and Emergency Response stated that, while the  department and its co-SSA (DHS) intended to develop a survey to  determine sector-wide improvements, consolidating voluntarily shared  information will not reflect the depth and breadth of sector  stakeholders, as organizations that share information will not  collectively represent a sector.

In April 2019, NIST issued the NIST Roadmap for Improving Critical  Infrastructure Cybersecurity, version 1.1, which included a self- assessment tool that provided a mechanism for individual  organizations to self-assess how effectively they manage  cybersecurity risks in the context of broader enterprise risk  management activities and identify improvement opportunities. In  addition to the road map, NIST’s framework included a section that  encouraged organizations to incorporate measurements of their risks,  which can be used to identify sector-wide improvements related to  using the framework.

In addition, as previously mentioned, DHS, in partnership with its IT  sector partners, administered a survey to the small and mid-sized IT  sector organizations to gather information on, among other things,  framework adoption, challenges, and related improvements. While  DHS did not plan to report on the results until 2020, the survey was  intended to help the department in identifying improvements across  the small and mid-sized IT sector organizations. The survey was  administered to the small and mid-sized organizations within the IT  sector. DHS officials stated that any small or mid-sized business  across all critical infrastructure sectors could complete the survey and  that the department had promoted the survey to all sectors.

Moreover, among all 16 sectors, only DOT and its co-SSA (DHS) had  considered the applicability of a similar approach for their sector  organizations. Specifically, DOT, in conjunction with DHS, plans to  distribute a survey intended to cover framework adoption, challenges,  and related improvements across the sector. DOT officials stated that  the survey completion is contingent upon DHS’s Transportation  Security Administration’s coordination of the review and approval  process to meet Paperwork Reduction Act compliance  requirements.

Three SSAs, four SCCs, one ISAC, and seven organizations stated  that identifying sector-wide improvements as a result of using the  framework was difficult due to organizations struggling with  determining the direct impact from framework use. For example, the  Department of Energy officials from the Office of Cybersecurity,  Energy Security, and Emergency Response stated that the sector  cannot relate improvements to any one framework or model because  the sector organizations are engaged in numerous concurrent public  and private cybersecurity initiatives, each of which could impact  cybersecurity to varying degrees. In addition, EPA officials from the  Office of Groundwater and Drinking Water stated that most  organizations will not be able to link improvements directly to the  framework because EPA does not exclusively incorporate the  framework into the agency’s sector guidance. The officials added that  existing industry standards and best practices are also recognized in  the development of EPA cybersecurity guidance. Therefore, although  an organization might experience improvements from using elements  of the framework, it might not be readily apparent that those  improvements came directly from the framework.

To provide the sector organizations with access to various framework  resources, NIST updated its website to include sector-specific  implementation guidance and case studies, as well as insights from  organizations using the framework.

Five organizations identified the lack of use cases as an impediment  to determining improvements. For example, one organization stated  that small and medium organizations struggled with identifying  improvements from using the framework because of the lack of use  cases (examples for how to determine or measure improvements as a  result of using the framework). To address the challenge, the  organization stated that it would be helpful if NIST, in collaboration  with federal and nonfederal entities, would share and provide use  cases or direction on common scenarios small and medium  organizations faced and how these could be addressed through the  framework.

NIST officials stated that they were in the early stages of developing a  cybersecurity framework starter profile for small organizations. NIST  officials stated that they did not have a time frame for completing the  profile. However, they added that the profile will aim to identify  common solutions to a specific challenge, such as threat surface or  cybersecurity challenges in cloud computing, using a customized  adaptation of the framework.

In addition, DHS created a small and midsize business road map for  all critical infrastructure sectors in 2018. The road map provided a  guide for small and mid-sized businesses to use in enhancing their  cybersecurity posture. The road map also included DHS’s  cybersecurity information sharing and collaboration program and  secure information sharing portal. The purpose of the information  sharing and collaboration program was to enable actionable, relevant,  and timely unclassified information exchange through trusted public- private partnerships across all critical infrastructure sectors. In  addition, the secure information sharing portal served as a forum to  share cybersecurity strategies and insights with the critical  infrastructure sectors.

Five organizations identified the lack of a centralized information  sharing mechanism as an impediment. For example, one organization  stated that there is a challenge in sharing information among all  critical infrastructure sectors in a more open and non-judgmental way.  To address this challenge, the organization stated that it would be  helpful to establish a centralized information sharing mechanism to  share and exchange information in an anonymous manner. Another  organization added that the challenge with determining improvements  is that there is no centralized information sharing mechanism to obtain  information. The organization added that it would be helpful to see  how organizations compare with one another in terms of goals  through this type of mechanism.

DHS, however, identified its homeland security information network as  a tool that was intended to be the primary system used by entities to  collaborate to protect critical infrastructure. Officials in DHS’s  Stakeholder Engagement and Cyber Infrastructure Resilience division  stated that the information in its homeland security information  network could be used by all sectors to report on best practices,  including sector-wide improvements and lessons learned from using  the framework.

Although NIST and DHS have identified initiatives to help address the  impediments, the SSAs have not reported on sector-wide improvements.  Until they do so, the extent to which the 16 critical infrastructure sectors  are better protecting their critical infrastructures from threats will be  largely unknown.

Most of the SSAs have not determined the level and type of framework  adoption, as we previously recommended. Most of the sectors, however,  had efforts underway to encourage and facilitate use of the framework.  Even with this progress, implementation of our recommendations is  essential to the success of protection efforts.

While selected organizations reported varying levels of improvements, the  SSAs have not collected and reported sector-wide improvements as a  result of framework use. The SSAs and organizations identified  impediments to collecting and reporting sector-wide improvements,  including the lack of precise measurements of improvement, voluntary  nature of the framework, and lack of a centralized information sharing  mechanism. However, NIST and DHS have initiatives to help address  these impediments. These included an information security measurement  program, cybersecurity framework starter profile, information sharing  programs, self-assessment tools, and surveys to support SSAs in  measuring and quantifying improvements in the protection of critical  infrastructure as a result of using the framework. However, NIST has yet  to establish time frames for completing the information security  measurement program and starter profile. Moreover, the SSAs have yet  to report on sector-wide improvements using the initiatives. Until they do  so, the critical infrastructure sectors may not fully understand the value of  the framework to better protect their critical infrastructures from cyber  threats.

We are making the following 10 recommendations to NIST and the nine  sector-specific agencies.

The Director of NIST should establish time frames for completing NIST’s  initiatives, to include the information security measurement program and  the cybersecurity framework starter profile, to enable the identification of  sector-wide improvements from using the framework in the protection of  critical infrastructure from cyber threats. (Recommendation 1)

The Secretary of Agriculture, in coordination with the Secretary of Health  and Human Services, should take steps to consult with respective sector  partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect  and report sector-wide improvements from use of the framework across  its critical infrastructure sector using existing initiatives. (Recommendation  2)

The Secretary of Defense should take steps to consult with respective  sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to  collect and report sector-wide improvements from use of the framework  across its critical infrastructure sector using existing initiatives.  (Recommendation 3)

The Secretary of Energy should take steps to consult with respective  sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to  collect and report sector-wide improvements from use of the framework  across its critical infrastructure sector using existing initiatives.  (Recommendation 4)

The Administrator of the Environmental Protection Agency should take  steps to consult with respective sector partner(s), such as the SCC, DHS,  and NIST, as appropriate, to collect and report sector-wide improvements  from use of the framework across its critical infrastructure sector using  existing initiatives. (Recommendation 5)

The Administrator of the General Services Administration, in coordination  with the Secretary of Homeland Security, should take steps to consult  with respective sector partner(s), such as the Coordinating Council and  NIST, as appropriate, to collect and report sector-wide improvements  from use of the framework across its critical infrastructure sector using  existing initiatives. (Recommendation 6)

The Secretary of Health and Human Services, in coordination with the  Secretary of Agriculture, should take steps to consult with respective  sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to  collect and report sector-wide improvements from use of the framework  across its critical infrastructure sector using existing initiatives.   (Recommendation 7)

The Secretary of Homeland Security should take steps to consult with  respective sector partner(s), such as the SCC and NIST, as appropriate,  to collect and report sector-wide improvements from use of the framework  across its critical infrastructure sectors using existing initiatives.  (Recommendation 8)

The Secretary of Transportation, in coordination with the Secretary of  Homeland Security, should take steps to consult with respective sector  partner(s) such as the SCC and NIST, as appropriate, to collect and  report sector-wide improvements from use of the framework across its  critical infrastructure sector using existing initiatives. (Recommendation 9)

The Secretary of the Treasury should take steps to consult with  respective sector partner(s), such as the SCC, DHS, and NIST, as  appropriate, to collect and report sector-wide improvements from use of  the framework across its critical infrastructure sector using existing  initiatives. (Recommendation 10)

We received comments on a draft of this report from the ten agencies to  which we made recommendations—the Departments of Agriculture,  Commerce, Defense, Energy, Health and Human Services, Homeland  Security, Transportation, and the Treasury; and the Environmental  Protection Agency and the General Services Administration. Among  these agencies, eight agreed with the recommendations, one neither  agreed nor disagreed with the recommendation, and one partially agreed  with the recommendation.

In written comments, the Department of Agriculture generally concurred  with the recommendation in our report. The department’s comments are  reprinted in appendix II.

In written comments, the Department of Commerce concurred with the  recommendation in our report. The department stated that the National  Institute of Standards and Technology expects to document its  cybersecurity measurement program scope, objectives, and approach by  about June 2020 and publish two cybersecurity starter profiles by about  September 2020. The department’s comments are reprinted in appendix  III.

In written comments, the Department of Defense concurred with the  recommendation in our report and described ongoing steps to evaluate  defense organizations’ cybersecurity maturity levels. The department’s  comments are reprinted in appendix IV.

In written comments, the Department of Energy partially concurred with  the recommendation in our report. The department stated that it will  coordinate with the energy sector to develop an understanding of sector- wide improvements from use of the framework.

The department, however, stated that implementing our recommendation  as written prescribes the SCC as a forum for coordination regarding the  framework. Our recommendation is not intended to be prescriptive, but  rather, to provide suggestions for consideration. Thus, we have revised  the wording of the recommendation to emphasize coordination with other  entities, as appropriate.

The department also stated that the recommendation implies that  improvements from the use of the framework could accurately be  attributed to a single initiative, which may be misleading. We do not  agree. Our report identifies the challenge of determining the direct impact  from framework use and notes that NIST’s website provides the sector  organizations with access to various framework resources, to include  sector-specific implementation guidance and case studies, as well as  insights from organizations using the framework. Hence, organizations  can report on improvements from use of the framework using multiple  initiatives.

Further, the department stated that suggesting government collection and  reporting of information regarding adoption or improvements erodes the  voluntary character of the framework. We do not agree with this  statement. Our report recognizes the voluntary character of the  framework but also notes that, without collecting and reporting such  information, critical infrastructure sectors may not fully understand the  benefits and value of the framework to better protect their critical  infrastructures from cyber threats. The department’s comments are  reprinted in appendix V.

In written comments, the Department of Health and Human Services  concurred with the recommendation in our report and stated that it would  work with the appropriate entities to refine and communicate best  practices to the sector. The department’s comments are reprinted in  appendix VI.

In written comments, the Department of Homeland Security concurred  with the recommendation in our report. The department stated that, once  it receives the results of the survey on framework adoption that it sent to  small- and mid-sized IT sector partners, it will determine the feasibility of  issuing similar surveys to other sectors. The department’s comments are  reprinted in appendix VII.

In written comments, the Department of the Treasury neither agreed nor  disagreed with the recommendation in our report. The department stated  that it will assess using the identified initiatives and their viability for  collecting and reporting sector-wide improvements from use of the  framework with input from the SCC and financial regulators. The  department added, however, that it does not have the authority to compel  financial institutions to respond to inquiries regarding the sector’s use of  the framework or resulting improvements. We acknowledge the lack of  authority but believe that implementing the recommendation to gain a  more comprehensive understanding of the framework’s use by the critical  infrastructure sector is essential to the success of protection efforts. The  department’s comments are reprinted in appendix VIII.

In written comments, the Environmental Protection Agency concurred  with the recommendation in our report. The agency stated that it will  coordinate with its SCC to investigate options to collect and report sector- wide improvements from use of the cybersecurity framework that are  consistent with statutory requirements and the sector's willingness to  participate. The agency’s comments are reprinted in appendix IX.

In written comments, the General Services Administration concurred with  the recommendation in our report and stated that it is working with the  Department of Homeland Security to develop a plan to address the  recommendation. The agency’s comments are reprinted in appendix X.

In comments sent via e-mail, the Department of Transportation’s Director  of Audit Relations and Program Improvement stated that the department  concurred with the recommendation in our report.

In addition to the aforementioned comments, we received technical  comments from officials of the Departments of Agriculture, Energy, Health  and Human Services, Homeland Security, Transportation, and Treasury.  We also received technical comments on the report from the  Environmental Protection Agency and General Services Administration.  We incorporated the technical comments in the report, where appropriate.

We are sending copies of this report to the appropriate congressional  committees; the Secretaries of Agriculture, Commerce, Defense, Energy,  Health and Human Services, Homeland Security, Transportation, and  Treasury; the Administrators of the Environmental Protection Agency and  General Services Administration; and other interested parties. In addition,  the report will be available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-6240 or at dsouzav@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix XI.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which (1) agencies with  lead roles in critical infrastructure protection efforts, referred to as sector- specific agencies (SSAs), have determined the level and type of National  Institute of Standards and Technology Cybersecurity Framework  (framework) adoption and (2) implementation of the framework has led to  improvements to the protection of critical infrastructure from cyber  threats.

To address the first objective, we analyzed documentation and evidence,  such as implementation guidance and survey instruments that discussed  actions federal and nonfederal entities have taken since our report in  2018 to develop methods to determine the level and type of adoption  across their sectors, as we previously recommended. These entities  included nine SSAs,13 out of the 16 Sector Coordinating Councils (SCC)  representing all 16 critical infrastructure sectors established in federal  policy, the National Institute of Standards and Technology (NIST), and  Information Sharing and Analysis Centers (ISAC). We also analyzed  documentation from the SSAs and SCCs, such as the Department of  Energy’s Cybersecurity Capability Maturity Model and the Department of  the Treasury’s Financial Services Sector Cybersecurity Profile. We  compared these to best practices, such as the National Infrastructure  Protection Plan and the Standards for Internal Control in the Federal  Government to determine efforts to facilitate framework adoption across  the sectors. We supplemented our review by interviewing officials from  these entities to determine any actions taken to determine framework  adoption.

In addition, we selected six critical infrastructure sectors identified in the  2018 National Cyber Strategy of the United States of America as having  critical infrastructure with the greatest risk of being compromised. The six  sectors were (1) communications, (2) financial services, (3) energy, (4)  healthcare and public health, (5) information technology, and (6)  transportation systems. We asked SCCs, trade associations (e.g., the  American Petroleum Institute), and ISACs to provide a list of  organizations that were users of the framework. We divided up the list of  identified organizations by sector, and we randomly selected one large  and one small or medium organization from each sector, resulting in a  final list of 12 organizations. We then conducted semi-structured  interviews with officials from the selected organizations to understand the  extent to which these organizations were using the framework.

To address the second objective, we collected and reviewed  documentation from NIST and the federal and nonfederal entities, such  as NIST’s framework and its April 2019 Roadmap for Improving Critical  Infrastructure Cybersecurity, the Department of Homeland Security’s  Information Technology Sector Small and Midsize Business  Cybersecurity Survey and 2018 Cybersecurity Resources Road Map,  and other SSA efforts to determine ongoing efforts to enable the  identification and measurement of improvements as a result of using the  framework. We compared these efforts to the 2014 Cybersecurity Act and  best practices, such as NIST Special Publication 800-55 on performance- based measures to determine the measures the SSAs and SCCs had  taken to determine improvements from using the framework.

In addition, we interviewed officials from the selected organizations to  understand the extent to which they realized improvements as a result of  framework adoption and the support the organizations received from  federal and nonfederal entities. We also interviewed officials from other federal and nonfederal entities, to include NIST, nine SSAs, 13 of the 16  SCCs, and six ISACs on efforts to measure improvements from use of the  framework, and any related challenges.

Appendix II: Comments from the Department of Agriculture

Appendix III: Comments from the Department of Commerce

Appendix IV: Comments from the Department of Defense

Appendix V: Comments from the Department of Energy

Appendix VI: Comments from the Department of Health and Human Services

Appendix VII: Comments from the Department of Homeland Security

Appendix VIII: Comments from the Department of the Treasury

Appendix IX: Comments from the Environmental Protection Agency

Appendix X: Comments from the General Services Administration

Appendix XI: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Neelaxi Lakhmani (assistant  director), Kendrick M. Johnson (analyst in charge), Christopher Businsky,  Nancy Glover, Douglas Harris, Ceara Lance, Edward Malone, Gabriel  Nelson, Harold Podell, and Dana Pon made key contributions to this  report.

Q: How does the government help keep banks, water systems, and other critical infrastructure from getting hacked?

A: A federal agency that issues standards and procedures—NIST—has a cybersecurity framework that critical infrastructure organizations can adopt.

All 12 organizations in our review were voluntarily using the framework, and told us they’ve seen benefits. For example, one organization said that the framework allowed it to better identify and address cybersecurity risks.

However, the agencies with lead roles in protecting critical infrastructure are not collecting or reporting on improvements from using the framework as we recommended.