Cybersecurity: Agencies Need to Fully Establish Risk Management Programs and Address Challenges

Federal agencies face a growing number of cyber threats to their systems and data. To protect against these threats, federal law and policies emphasize that agencies take a risk-based approach to cybersecurity by effectively identifying, prioritizing, and managing their cyber risks. In addition, OMB and DHS play important roles in overseeing and supporting agencies' cybersecurity risk management efforts.

GAO was asked to review federal agencies' cybersecurity risk management programs. GAO examined (1) the extent to which agencies established key elements of a cybersecurity risk management program; (2) what challenges, if any, agencies identified in developing and implementing cybersecurity risk management programs; and (3) steps OMB and DHS have taken to meet their risk management responsibilities and address any challenges agencies face. To do this, GAO reviewed policies and procedures from 23 civilian Chief Financial Officers Act of 1990 agencies and compared them to key federal cybersecurity risk management practices, obtained agencies' views on challenges they faced, identified and analyzed actions taken by OMB and DHS to determine whether they address agency challenges, and interviewed responsible agency officials.

Key practices for establishing an agency-wide cybersecurity risk management program include designating a cybersecurity risk executive, developing a risk management strategy and policies to facilitate risk-based decisions, assessing cyber risks to the agency, and establishing coordination with the agency's enterprise risk management (ERM) program. Although the 23 agencies GAO reviewed almost always designated a risk executive, they often did not fully incorporate other key practices in their programs:

Twenty-two agencies established the role of cybersecurity risk executive, to provide agency-wide management and oversight of risk management.

Sixteen agencies have not fully established a cybersecurity risk management strategy to delineate the boundaries for risk-based decisions.

Seventeen agencies have not fully established agency- and system-level policies for assessing, responding to, and monitoring risk.

Eleven agencies have not fully established a process for assessing agency-wide cybersecurity risks based on an aggregation of system-level risks.

Thirteen agencies have not fully established a process for coordinating between their cybersecurity and ERM programs for managing all major risks.

Until they address these practices, agencies will face an increased risk of cyber-based incidents that threaten national security and personal privacy.

Agencies identified multiple challenges in establishing and implementing cybersecurity risk management programs (see table).

GAO is making 57 recommendations to the 23 agencies and one to OMB, in coordination with DHS, to assist agencies in addressing challenges. Seventeen agencies agreed with the recommendations, one partially agreed, and four, including OMB, did not state whether they agreed or disagreed. GAO continues to believe all its recommendations are warranted.

Federal agencies face cyber threats that continue to grow in number and  sophistication. Yet, as GAO has previously reported, agencies have  struggled to implement programs to effectively manage the risks to their  information and information systems.

To protect against cyber threats, agencies must make decisions about  how to most effectively secure their systems and data, based on an  assessment of the risks they face. The Federal Information Security  Modernization Act of 2014 (FISMA), executive orders, and guidance  from the Office of Management and Budget (OMB) explicitly emphasize  using risk-based processes for information security. In addition, the  National Institute of Standards and Technology (NIST) has developed a  framework for managing cybersecurity risk at the agency, business, and  system levels.

Executive Order (EO) 13800, issued in May 2017, states that agency  heads are to be held accountable for implementing risk management  measures commensurate with the risk and magnitude of the harm that  would result from unauthorized access, use, disclosure, disruption,  modification, or destruction of IT and data.  Toward this end, the EO sets  forth a number of specific actions to be taken by agencies, OMB, and the  Department of Homeland Security (DHS) in order to evaluate and  improve cybersecurity risk management across the executive branch.

You asked us to conduct a review of federal agencies’ cybersecurity risk  management programs. Accordingly, our review examined  (1) the extent to which agencies established key elements of a  cybersecurity risk management program;  (2) what challenges, if any, agencies identified in developing and  implementing cybersecurity risk management programs; and  (3) what steps OMB and DHS have taken to meet their risk management  responsibilities under EO 13800 and to address any challenges agencies  face in implementing cyber risk management practices.

In conducting this engagement, we focused on the 23 civilian Chief  Financial Officers Act of 1990 (CFO Act) agencies. We excluded the  Department of Defense, because the department determined the  information we requested pertaining to cybersecurity risk management to  be classified and, therefore, not available in a public report.

To address our first objective, we reviewed policies, procedures, and  other documentation from the 23 agencies and compared them to  selected federal practices identified in OMB and NIST guidance. In  selecting the practices for our assessment, we focused on those practices  identified by OMB and NIST as foundational for an organization-wide  approach to cybersecurity risk management. We also interviewed  cognizant agency officials regarding any gaps we identified in agencies’  policies and procedures and to understand their approach to  cybersecurity risk management.

To address the second objective, we developed and administered  structured interview questions to officials responsible for cybersecurity  risk management at the 23 agencies to obtain these officials’ views on  challenges the agencies face in developing and implementing policies  and procedures for managing cybersecurity risk. Specifically, we  developed a list of potential challenges based on our assessment of  agencies’ policies and procedures, a review of OMB’s risk report on  agencies’ cybersecurity risk management capabilities, and reviews of  prior GAO reports in areas related to cybersecurity risk management. We  asked agency officials to indicate if they experienced these, or any other,  challenges in establishing their cybersecurity risk management programs.  We also asked them to provide specific examples. We received  responses from all 23 agencies. We analyzed the responses to identify  those challenges that were identified by a majority of the agencies.

To address the third objective, we reviewed EO 13800 and  implementation guidance issued by OMB, as well as relevant reports and  other documentation, including OMB’s Federal Cybersecurity Risk  Determination Report and Action Plan, OMB memos, and supporting  documentation for DHS initiatives. We also interviewed OMB and DHS  officials to gain an understanding of these and other relevant initiatives  under way to help agencies implement their cybersecurity risk  management programs. We then compared the initiatives to the  challenges identified by agencies to determine if they addressed the  challenges.

We conducted this performance audit from February 2018 to July 2019 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. A more complete description  of our objectives, scope, and methodology is provided in appendix I.

Federal agencies are dependent on information technology (IT) systems  and electronic data to carry out operations and to process, maintain, and  report essential information. These systems are highly complex and  dynamic, technologically diverse, and often geographically dispersed.  However, the IT systems supporting federal agencies and our nation’s  critical infrastructures are at risk.

Information and systems are subject to serious threats that can have  adverse impacts on organizational operations and assets, individuals,  other organizations, and the nation. These threats can include purposeful  attacks, environmental disruptions, and human/machine errors, and may  result in harm to the national and economic security interests of the  United States.

In recognition of the growing threat, we designated information security as  a government-wide high-risk area since 1997. In 2003, we expanded the  information security high-risk area to include the protection of critical  cyber infrastructure. We further expanded the information security high- risk area in 2015 to include protecting the privacy of personally  identifiable information.

Cybersecurity incidents continue to impact federal agencies, as well as  entities across various critical infrastructure sectors. In fiscal year 2017,  federal executive branch civilian agencies reported 35,277 incidents to  the U.S. Computer Emergency Readiness Team. These incidents  included web-based attacks, phishing, and the loss or theft of computing  equipment. These incidents and others like them can pose a serious  challenge to economic and national security and personal privacy. The  following examples highlight the impact of such incidents:  In January 2019, the Department of Justice (Justice) announced that  it had indicted two Ukrainian men for their roles in a large-scale,  international conspiracy to hack into the Securities and Exchange  Commission’s computer systems and profit by trading on critical  information they stole. The indictment alleges that the two hacked into  the Commission’s Electronic Data Gathering, Analysis, and Retrieval  system and stole thousands of files, including annual and quarterly  earnings reports containing confidential, non-public, financial  information, which publicly traded companies are required to disclose  to the Commission.

In March 2018, a joint alert from DHS and the Federal Bureau of  Investigation stated that Russian government actors had been  targeting the systems of multiple U.S. government entities and critical  infrastructure sectors since at least March 2016. These Russian  government actors had affected multiple organizations in various  sectors, to include energy, nuclear, water, aviation, construction, and  critical manufacturing. DHS and the Federal Bureau of Investigation  characterized this activity as a multi-stage intrusion campaign by  Russian government cyber actors who targeted small commercial  facilities’ networks where they staged malware,  conducted spear  phishing, and gained remote access into energy sector networks.

In June 2015, the Office of Personnel Management (OPM) reported  that an intrusion into its systems had affected the personnel records of  about 4.2 million current and former federal employees. Then, in July  2015, the agency reported that a separate, but related, incident had  compromised its systems and the files related to background  investigations for 21.5 million individuals. In total, OPM estimated 22.1  million individuals had some form of personally identifiable information  stolen, with 3.6 million being a victim of both breaches.

The risks to IT systems supporting the federal government and the  nation’s critical infrastructure are increasing as security threats continue  to evolve and become more sophisticated. These risks include insider  threats from witting or unwitting employees, escalating and emerging  threats from around the globe, steady advances in the sophistication of  attack technology, and the emergence of new and more destructive  attacks. Therefore, it is imperative for agency leaders and managers at all  levels to manage the risks associated with the operation and use of  information systems that support their missions and business functions.

Cybersecurity risk management comprises a full range of activities  undertaken to protect IT and data from unauthorized access and other  cyber threats; maintain awareness of cyber threats; detect anomalies and  incidents adversely affecting IT and data; and mitigate the impact of,  respond to, and recover from incidents. Information sharing facilitates and  supports all of these activities.

Federal Law and Policy Set Roles and Responsibilities for Protecting Federal Systems and Managing Cybersecurity Risk

Several federal laws, executive orders, and policies establish  requirements for protecting federal systems and managing cybersecurity  risks. Specifically, FISMA is intended to provide a comprehensive  framework for ensuring the effectiveness of information security controls  over information resources that support federal operations and assets, as  well as the effective oversight of information security risks. The act  requires each agency to develop, document, and implement an agency- wide information security program to provide risk-based protections for  the information and information systems that support the operations and  assets of the agency, including those provided or managed by another  entity.

FISMA also assigns government-wide responsibilities to key agencies:

OMB is responsible for developing and overseeing implementation of  policies, principles, standards, and guidelines on information security  in federal agencies, except with regard to national security systems.

DHS is responsible for certain operational aspects of agencies’  information security policies and practices, including assisting OMB in  fulfilling its FISMA authorities, issuing binding operational directives,  monitoring agencies’ security policies and practices, and assisting  them with implementation.

NIST is responsible for developing standards for categorizing  information and information systems, security requirements for  information and systems, and guidelines for detection and handling of  security incidents.

More recently, the administration has re-emphasized the importance of  improving agencies’ cybersecurity risk management capabilities through  the issuance of an executive order. Further, OMB has issued minimum  requirements, standards, and guidance to ensure federal managers are  effectively managing cybersecurity risks. OMB has also issued policies for  enterprise risk management (ERM), which considers all key risks that  agencies face and their potential impacts on the agency’s mission.  Cybersecurity risk is just one type of risk that agencies consider in their  enterprise approach to risk management. Table 1 identifies the  administration’s May 2017 executive order and relevant OMB publications  and guidance on cybersecurity risk management.

In its responsibility for certain operational aspects of agencies’  implementation of cybersecurity practices, DHS is spearheading several  initiatives to assist federal agencies in protecting their computer networks  and electronic information. Examples of DHS’s initiatives are described in  table 2.

NIST Has Established a Framework for Federal Cybersecurity Risk Management Activities

Implementing effective cybersecurity requires any organization—whether  a private sector company; a non-profit entity; or an agency at the state,  local, or federal level—to identify, prioritize, and manage cyber risks  across its enterprise. Risk management is a comprehensive process that  requires organizations to (1) frame risk (i.e., establish the context for risk- based decisions), (2) assess risk, (3) respond to risk once determined,  and (4) monitor risk on an ongoing basis using effective organizational  communications and a feedback loop for continuous improvement in the  risk-related activities of organizations.

In accordance with its responsibilities under FISMA, as well as other laws  and executive orders, NIST has developed a framework for managing risk  to federal information and information assets. This framework calls for a  multi-tiered approach to risk management, with activities at the  information system (system), business/mission, and organization  (e.g., agency) level. Cybersecurity risk management activities at the  organization level provide the foundation for activities at the  mission/business process and system levels, such as the selection and  implementation of security controls and decisions about the operation of  systems based on a determination of risk. Figure 1 illustrates an  organization-wide approach to cybersecurity risk management.

Guidance for federal agencies’ cybersecurity risk management processes  is found in a suite of NIST special publications. Table 3 highlights key  NIST cybersecurity risk management publications.

Federal Guidance Includes Key Steps for Establishing Cybersecurity Risk Management Programs

OMB and NIST guidance identify practices for establishing agency-wide  cybersecurity risk management programs.  Among other things, these  activities are intended to facilitate better communication between senior  leaders and executives and system owners and operators; align agency  priorities with resource allocation and prioritization at the system level;  and convey acceptable limits regarding the selection and implementation  of controls within the established organizational risk tolerance. Practices  that provide a foundation for an agency’s cybersecurity risk management  program are summarized in table 4.

Establish the role of a cybersecurity risk executive: In order to ensure  that cybersecurity risks are being addressed across the agency, NIST  Special Publication 800-39 states that agencies should establish a  cybersecurity risk executive. This can take the form of an individual or  group that provides agency-wide oversight of cybersecurity risk activities  and facilitates collaboration among stakeholders and consistent  application of the cybersecurity risk management strategy. The  cybersecurity risk executive should ensure that risk-related considerations  for information systems are viewed from an agency-wide perspective  regarding the strategic goals and objectives. The cybersecurity risk  executive also should ensure that cybersecurity risk is managed  consistently across the agency, reflects organizational risk tolerance, and  is considered along with other types of risk to ensure mission/business  success.

Develop a cybersecurity risk management strategy: According to  NIST Special Publication 800-39 and other guidance, agencies should  develop a cybersecurity risk management strategy to provide a  foundation for managing risk and delineate the boundaries for risk-based  decisions. The strategy should describe the strategic-level decisions and  considerations that senior leaders and executives are to use to manage  security and privacy risks to agency operations, assets, individuals, other  organizations, and the nation. The strategy should also guide and inform  how security and privacy risks are framed, assessed, responded to, and  monitored. The strategy should include (1) a statement of the agency’s  risk tolerance, (2) how it intends to assess risk (e.g., acceptable risk  assessment methodologies), (3) acceptable risk response strategies  (e.g., acceptance, mitigation, avoidance), and (4) how the agency intends  to monitor risk over time.

Document risk-based policies: NIST Special Publication 800-37  identifies foundational activities at the agency and information system  levels that should be included in policies to help prepare agencies to  manage security and privacy risks.  These activities should be guided by  risk-based decisions. Specific elements of such risk-based policies  include (1) identifying and assigning individuals with key roles for  executing the risk management framework; (2) requiring an agency-wide  assessment of cyber risks; (3) identifying and documenting common  security controls that can be inherited by multiple information systems; (4) developing an agency-wide strategy for monitoring control effectiveness;  (5) requiring system-level risk assessments to be performed and regularly  updated; (6) tailoring system security controls based on risk; (7)  prioritizing remedial actions to correct vulnerabilities identified in plans of  action and milestones (POA&M) based on risk; and (8) using a  determination of risk to make decisions about system operation and use.

Conduct an agency-wide cybersecurity risk assessment: According  to NIST Special Publications 800-39 and 800-37, agencies should assess  cybersecurity and privacy risks and update the results on an ongoing  basis. Risk assessment at the agency level is based primarily on  aggregated information from system-level risk assessment results,  continuous monitoring, and any relevant strategic risk considerations. The  assessment is intended to help the agency consider the totality of risk  derived from the operation and use of its information systems and from  information exchanges and connections with other internally and  externally owned systems. Such assessments may identify systemic  weaknesses or deficiencies discovered in multiple information systems  and assess the overall risks that these present to operations, assets, and  individuals.

Establish coordination between cybersecurity and enterprise risk  management: ERM, as a discipline, deals with identifying, assessing,  and managing risks. OMB has stated that an effective enterprise risk  management program should promote a common understanding for  recognizing and describing potential risks that can impact an agency’s  mission and the delivery of services to the public. Such risks include  strategic, market, cyber, legal, reputational, political, and a broad range of  operational risks.

Toward this end, OMB Circular A-123 directs agencies to implement a  capability for enterprise risk management. Specifically, it encourages  agencies to establish a risk management governance structure, such as a  risk management council, which may be integrated with existing  management structures; develop “risk profiles” that identify risks arising  from mission and mission-support operations; and consider those risks as  part of the annual strategic review process.

Because cybersecurity is a key risk facing virtually every federal agency,  it is important for coordination to exist between agencies’ ERM functions  and their cybersecurity risk management programs, particularly the  cybersecurity risk executive. NIST SP 800-39 states that effective risk  management requires an agency’s mission/business processes to  explicitly account for information security risk when making operational  decisions and that cybersecurity risk information should be shared with  key stakeholders throughout the organization. According to NIST, the risk  executive should serve as a common risk management resource for  senior leaders, mission/business owners, and other organization officials  and as a focal point for communicating and sharing information security  risk-related information among key stakeholders. OMB has also raised  concerns that agencies’ ERM programs do not effectively identify, assess,  and prioritize actions to mitigate cybersecurity risks in the context of other  enterprise risks. GAO has also emphasized the importance of sharing  risk information with stakeholders as part of an effective risk management  program.

Agencies Have Not Fully Established Elements of Their Cybersecurity Risk Management Programs

The 23 civilian CFO Act agencies varied in the extent to which they had  established key elements of their cybersecurity risk management  programs. Specifically, 22 of the 23 agencies established the role of  cybersecurity risk executive, and most of the 23 agencies had established  policies that include elements to ensure their activities are guided by risk- based decisions. However, fewer than half of the agencies developed an  agency-wide cybersecurity risk management strategy or fully established  coordination with their enterprise risk management function. Figure 2  summarizes the extent to which the agencies had established these  elements as of April 2019.

Most Agencies Established the Role of Cybersecurity Risk Executive

Twenty-two of the 23 civilian CFO Act agencies established a  cybersecurity risk executive to provide agency-wide oversight of  cybersecurity risk activities. Agencies varied in assigning this  responsibility to the chief information officer (CIO), chief information  security officer (CISO), or another official or entity. For example:

At the Department of Health and Human Services (HHS), the CIO  serves as the risk executive for the department, and is responsible for  executing the Risk Management Framework tasks outlined in NIST  SP 800-37.

The United States Agency for International Development (USAID)  designated the CISO with responsibility for carrying out the risk  executive functions for the agency. Among other things, the CISO is  responsible for developing, implementing, and managing an agency- wide security authorization process and a threat awareness program.

The Department of the Treasury (Treasury) assigned the function of  risk executive to its department CIO Council. The council’s  responsibilities include ensuring the cybersecurity program is  consistent with the provisions of NIST SP 800-39; providing guidance  to and oversight of the organization’s risk management program and  developing the cybersecurity risk management strategy;  communicating organization-wide threat, vulnerability, and risk-related  information; and providing a strategic view for managing cyber risk  throughout the organization.

One agency, the General Services Administration (GSA), had not defined  the role of its cybersecurity risk executive in its policy. Officials in GSA’s  Office of the CIO stated that they had not formally designated this role  because the agency’s risk executive responsibilities were shared among  the CIO, CISO, authorizing officials, and other GSA officials for risk  management. However, without clearly defining and documenting the  responsibility for the risk executive function, the agency may lack  consistent implementation and oversight of cybersecurity risk  management activities and an effective agency-wide view for managing  risk. Additional details on the 23 agencies’ cyber risk executive positions  are provided in appendix II.

Most Agencies Did Not Develop an Agency-Wide Cybersecurity Risk Management Strategy to Guide Their Risk Decisions

Among the 23 civilian CFO Act agencies, seven had developed a  cybersecurity risk management strategy that fully addressed the four  elements called for in the NIST guidance. Specifically, each of the seven  agencies (the Department of Commerce (Commerce), the Department of  Labor (Labor), the Department of State (State), USAID, GSA, OPM, and  the Social Security Administration (SSA)) had developed a strategy to  guide how cybersecurity risk is to be framed, assessed, responded to,  and monitored. For example, some of the strategies discussed risk  tolerance in terms of thresholds based on essential mission functions and  the processing of personally identifiable information or system impact  levels, types of data processed, and accessibility of systems, among  other factors. The strategies also included breakdowns of appropriate risk  response strategies and how the agencies intended to assess and  monitor risk.

In addition, five of the 23 agencies (the Department of Education  (Education), Environmental Protection Agency (EPA), National Science  Foundation (NSF), the Department of Transportation (Transportation),  and the Small Business Administration (SBA)) had partially developed  cybersecurity risk management strategies, but their strategies did not  address certain required elements. Specifically, while these agencies  developed strategic documents, these documents did not include all of  the required elements, such as a statement of risk tolerance or  acceptable risk mitigation strategies.

EPA officials stated that they intended to update their strategy documents  to address how the agency intends to assess risk, while Education and  NSF officials did not state whether they intended to update their strategy  to include a statement of risk tolerance, among other missing elements.  Transportation and SBA officials stated that they believed their existing  strategy documents addressed all the elements; however, neither  agency’s strategy included an expression of departmental risk tolerance  and risk mitigation strategies. Further, Transportation’s strategy did not  include a description of acceptable risk assessment methodologies.

The remaining 11 agencies had not developed an agency-wide  cybersecurity risk management strategy. These agencies offered a  variety of reasons for not doing so.

Seven agencies—the Department of Agriculture (Agriculture),  Department of Energy (Energy), HHS, Department of the Interior  (Interior), Treasury, the National Aeronautics and Space  Administration (NASA), and the Nuclear Regulatory Commission  (NRC)—acknowledged that they had not developed a cybersecurity  risk management strategy that includes the key elements. According  to agency officials, this was due to the federated nature of the agency  or difficulty in establishing an agency-wide understanding of risk  tolerance, among other factors. Further, these agencies stated that  they intended to develop such a strategy or were considering doing  so.

The other four agencies—DHS, the Department of Housing and  Urban Development (HUD), Department of Justice (Justice), and  Department of Veterans Affairs (VA)—stated that they believed their  existing documents and policies constituted a risk management  strategy. However, we determined that these documents did not  constitute an integrated strategy that addressed key elements such as  risk tolerance and risk mitigation strategies.

Without a comprehensive risk management strategy, the agencies may  lack an organization-wide understanding of acceptable risk levels and  appropriate risk response strategies to protect their systems and data.  Additional details regarding the 23 agencies’ establishment of  cybersecurity risk management strategies are discussed in appendix III.

Agencies Established Policies for Implementing Risk Management Activities, but Gaps Remain in Some Areas

Most of the 23 agencies had established policies that include elements to  ensure their activities are guided by risk-based decisions. However, many  agencies had gaps in one or more of these areas. Specifically, six  agencies (DHS, Education, Justice, Treasury, NSF, and SSA) addressed  all of these areas in their policies and procedures, while the remaining 17  agencies had not addressed at least one area. Table 5 discusses, for  each of these elements, which of the 23 agencies had addressed it in  their policies.

Eleven agencies—Agriculture, Commerce, Energy, HHS, Interior, Labor,  EPA, GSA, NASA, NRC, and OPM—generally agreed that their policies  lacked identified elements and either stated that they intended to update  policies to include them or would consider doing so.

The remaining six agencies—HUD, State, Transportation, VA, USAID,  and SBA—stated that they believed their policies addressed these  elements or that they carried out these activities in practice, but did not  provide documentation of policies that addressed them.

Without ensuring that their policies include all key risk management  activities, the agencies may not be taking the foundational steps needed  to effectively identify and prioritize activities to mitigate cybersecurity risks  that could result in the loss of sensitive data or compromise of agency  systems. Additional details on the agencies’ risk management policies are  provided in appendix IV.

About Half of the Agencies Developed an Agency- Wide Cybersecurity Risk Assessment Process

Twelve of the 23 civilian CFO Act agencies had developed a process or  mechanism for conducting an agency-wide cybersecurity risk  assessment. Specifically, these agencies (Agriculture, Education, Energy,  DHS, HUD, Interior, Justice, Labor, State, Transportation, NSF, and SSA)  had developed processes for aggregating system-level data and  analyzing them to assess overall cybersecurity risk to agency operations  and assets. For example, these 12 agencies developed scorecards or  dashboards that provided agency-wide views of key indicators  aggregated from system-level information and risk scores for agency  components. Officials from seven of these agencies described how these  assessments enable them to make enterprise-wide decisions on  prioritizing and remediating risks.

The remaining 11 agencies (Commerce, GSA, HHS, NASA,  NRC,  Treasury, VA, EPA, OPM, SBA, and USAID) offered a variety of reasons  for why they did not develop a process for assessing cybersecurity risks  at the agency level. Five agencies stated that they were still working to  develop or acquire tools that will allow them to aggregate system-level  data, and three of these noted that they expected further implementation  of DHS’s CDM initiative to provide this capability. The other six agencies  stated that they did conduct such an assessment in practice, but did not  provide sufficient documentation of the process they use.

Without a means of aggregating and assessing cybersecurity risks arising  from their information systems to the organizational level, these 11  agencies may be missing opportunities to identify trends or prioritize  investments in cybersecurity risk mitigation activities in order to target  widespread or systemic risks to the systems and organization. Additional  details of agencies’ processes for conducting organization-wide cyber risk  assessments are contained in appendix V.

Most Agencies Did Not Fully Establish Their Approach to Coordinating between Cybersecurity and Enterprise Risk Management

Ten of the 23 civilian CFO Act agencies provided evidence of having a  fully established process for coordination between their cybersecurity risk  executive and the entity responsible for overall ERM functions. Five  agencies provided evidence of a partially established process, and eight  could not provide evidence of such a process.

The ten agencies with fully established processes included this  coordination as part of their defined and documented ERM governance  structure and process. The agencies took steps to ensure such  coordination in a variety of ways. For example, eight agencies, including  Education and USAID, established a specific body, such as a risk  management council, with responsibility for ERM. These agencies  included their cybersecurity risk executive in the council’s membership in  order to facilitate coordination. Other agencies, such as the National  Science Foundation, ensured coordination through regular reporting or  briefings between their cybersecurity risk executive and their ERM  governance structure.

In addition, five agencies partially established an approach to  coordination in this area. These agencies provided some evidence of  coordination activities, but had not formally defined or documented this  coordination as part of their ERM structure or process. Specifically, four of  these agencies (Justice, the Department of Transportation  (Transportation), the Environmental Protection Agency (EPA), and the  Social Security Administration (SSA)), provided evidence of occasional  coordination between their cybersecurity risk executive and officials  responsible for ERM. However, they did not fully define and document  their ERM governance structures and processes, including how  coordination with the cybersecurity risk executive was to take place.

One agency—GSA—had not formally documented the position or  responsibilities of the cybersecurity risk executive in its policy. Thus, the  agency could not show that the risk executive was involved in ERM  activities, although the agency board responsible for ERM does include  the agency CIO as a co-chair.

Although they did not provide evidence of a fully documented process,  officials from these five agencies stated that they perform this  coordination in practice. However, documenting these processes would  help ensure a consistent, rather than ad-hoc, approach to communication  and coordination.

Lastly, eight agencies had not established an approach to coordination in  this area. In particular, these agencies (Agriculture, HHS, Interior, VA,  DHS, State, Treasury, and NRC) either did not have an ERM governance structure and/or did not provide evidence of a process for coordination  between their ERM governance structure and their cybersecurity risk  executive.

Officials from two of these agencies stated that they were still in the  process of formalizing their approach to ERM, while the other six stated  that such coordination occurs, even if processes may not be fully  documented. However, as noted previously, documenting these  processes would help ensure a consistent, rather than ad-hoc, approach  to communication and coordination.

Without regular coordination between the cybersecurity risk executive and  broader ERM entity, senior leadership responsible for ERM may not be  fully aware of significant cybersecurity risks and, thus, may not be  positioned to address them in the context of other risks and their potential  impacts on the mission of the agency. Additional details on agencies’  coordination processes are provided in appendix VI.

Agencies Identified a Variety of Challenges in Developing and Implementing Cybersecurity Risk Management Programs

Officials responsible for cybersecurity risk management at a majority of  the 23 civilian CFO Act agencies reported eight challenges in establishing  and implementing cybersecurity risk management programs. Most  commonly cited were challenges related to hiring and retaining qualified  personnel, competing priorities between cybersecurity and agency  mission or operations, and establishing and implementing consistent  cybersecurity risk management policies and procedures. Figure 3 shows  the challenges identified and the number of agencies reporting each  challenge.

Hiring and Retaining Key Cybersecurity Risk Management Personnel

All of the 23 civilian CFO Act agencies reported hiring and retaining  personnel to fill key cybersecurity risk management positions as a  challenge in establishing a cybersecurity risk management program. In  particular, six agencies cited the lengthy federal hiring process, and 14  noted the difficulty in competing with private-sector companies in salary  and other benefits. Further, 11 agencies noted that there is a shortfall in  candidates with the skills needed for cybersecurity risk management. For  example:

NASA’s Chief Cyber Risk Officer noted that cybersecurity risk  management is a multi-disciplinary field that blends technical cyber  expertise with project management principles and a business-focused  management background. This official stated that it is difficult to find  talent that possesses this multi-disciplinary experience, in part,  because current government marketing for cybersecurity skill sets  advertise for purely technical skills. The official added that, currently,  the government lacks clearly defined roles for cyber risk management  as a dedicated job function.

HUD’s  CIO saw this challenge as part of a larger shortfall of this  highly in-demand resource and noted that HUD must compete with  tech giants and Silicon Valley startups for qualified personnel. The  official stated that the executive order providing direct hiring  authorities for cybersecurity positions provides assistance, though the  department still needs to be creative in enhancing retention and  recruitment efforts through bonuses and other incentives.

A key to having a successful cybersecurity program is having a well- trained, highly qualified workforce that is versed in identifying cyber  threats and recognizes steps to take once confronted with them. Our work  has identified difficulties in recruiting and retaining qualified cybersecurity  professionals as a continuing challenge. If agencies are unable to hire  and retain qualified cybersecurity risk management personnel, they will  be hindered in establishing effective programs for cybersecurity risk  management.

Managing Competing Priorities between Operations and Cybersecurity

Nineteen of the 23 civilian CFO Act agencies reported competing  priorities between agency mission operations and cybersecurity as a  challenge. In particular, 12 agencies noted that cybersecurity  requirements are sometimes perceived as impeding mission activities,  such as deploying systems, sharing information, or providing public  services. In addition, four agencies highlighted the competition for limited  resources between cybersecurity risk management activities and  operational or mission needs. For example:

HHS’s  Acting Deputy CISO stated that, due to the federated nature of  the agency and the broad spectrum of its missions and business  functions, there is often a disconnect between security and  operational personnel. As an example, the official stated that  Operating Divisions that are research or academics focused will  require increased information sharing and flexibility, but this often  conflicts with cybersecurity concepts and processes.

Interior’s Deputy CIO stated that the need to balance mission priorities  with those related to cybersecurity risk management leads to fiscal  and operational challenges when making investment, architectural,  and operational decisions.

NIST emphasizes determining the relative importance of the  mission/business functions in order to make the appropriate level of risk  management investment. If agencies are unable to establish priorities  among cybersecurity and operational needs, they may be challenged in  allocating resources appropriately to ensure their systems and  information are appropriately secured.

Establishing and Implementing Consistent Cybersecurity Risk Management Policies and Procedures

Eighteen of the 23 civilian CFO Act agencies reported challenges in  establishing and implementing consistent cybersecurity risk management  policies and procedures across the organization. Eight agencies cited  challenges in this area arising from the difficulty in ensuring consistency  across a federated or decentralized organization, while other factors  included training staff and making them aware of policies, and the need to  integrate cybersecurity policies with missions and operations. For  example:

EPA’s CISO related that challenges in consistent implementation of  policies and procedures include the need to train individuals involved  in the risk management process, address different views of risk  appetite within the agency, and deal with varying perspectives on the  importance of cybersecurity, among other things.

OPM’s Deputy CISO highlighted that frequent changes in the  agency’s leadership (e.g., having eight CIOs since 2012) had led to  challenges with the agency’s ability to implement consistent policies in  an ongoing, streamlined manner. As we have previously reported,  CIOs and former agency IT executives believed it was necessary for a  CIO to stay in office for 3 to 5 years to be effective and 5 to 7 years to  fully implement major change initiatives in large public sector  organizations. In addition, the Deputy CISO stated that the  establishment and implementation of cybersecurity risk management  policies and procedures has been viewed as a secondary  responsibility, to be accomplished when more pressing and immediate  operational concerns do not need attention.

NIST has emphasized the importance of a consistent approach in order  for cybersecurity risk management to succeed at all levels of an agency.  If agencies are unable to establish consistent cybersecurity risk  management policies and procedures, they may not be able to effectively  prioritize and implement security and privacy activities to protect their  most critical assets and systems.

Establishing and Implementing Standardized IT Capabilities

Eighteen of the 23 civilian CFO Act agencies reported challenges in  establishing and implementing standardized IT capabilities across the  organization. Eleven of these agencies noted that decentralized or  federated organizations create difficulty in implementing standardized,  agency-wide tools and solutions to manage cybersecurity risks. In  addition, four agencies cited issues with legacy systems, which may not  always be compatible with capabilities intended to be used agency wide.  For example:

The Department of Commerce’s (Commerce) Deputy CISO stated  that, because Commerce is a largely federated agency, with each  bureau operating and maintaining its own environment, managing a  truly enterprise solution is challenging in numerous areas. For  example, the official stated that the department cannot control access  at bureaus due to disconnected networks, different security offices  and policies, and even different logical access policies. The official  added that a change in governance and thinking toward common  enterprise tools and solutions requires a shift in management and  thinking across the department and its bureaus.

Energy’s Acting Deputy CIO for Cybersecurity stated that the  department is working, to the degree possible, to implement  enterprise solutions for cybersecurity and continuous monitoring;  however, because the enterprise is comprised of laboratories and  sites with very diverse mission sets, doing so is always challenging.  This official added that the department has embraced the DHS CDM  initiative, which will be leveraged to standardize some IT cybersecurity  capabilities, but it does not have a single standardized solution across  the enterprise.

OMB recently noted that an agency’s ability to mitigate security  vulnerabilities becomes more complex in federated agencies, where there  are not standardized procedures or technology across the organization.   The challenges in implementing standardized IT capabilities may hinder  these agencies in applying a consistent level of protection to their  systems and data.

Receiving Quality Data to Provide Visibility into Risks

Eighteen of the 23 civilian CFO Act agencies reported that they had  experienced challenges in receiving quality data (e.g., accurate, timely  information on threats and vulnerabilities). Twelve of these agencies  expressed challenges in receiving data from all parts of their agencies or  stated that they relied on manual reporting from their components, which  did not provide real-time visibility into risks. In addition, six agencies cited  difficulties in combining data from disparate sources into an agency-wide  view of risk. For example:

DHS’s Acting Director of Governance and Executive Management  noted that the department’s management currently depends on its  components to submit timely and accurate information on  cybersecurity vulnerabilities instead of having real-time, centralized  reporting of data. The official added that DHS expects to address this  challenge through implementation of CDM centralized reporting to the  DHS Dashboard on a near real-time basis and other tools and  processes for enterprise data collection.

State’s Enterprise Risk Officer for Cybersecurity reported that threat  information is difficult to gather with the specificity needed to make  strategic decisions. The official added that, with regard to vulnerability  data, sufficient data exist and are gathered on a regular basis;  however, it is difficult in a large global enterprise to prioritize actions  without credible information on the likelihood of a threat or its impact  on the agency’s mission.

NIST emphasizes that risk monitoring tools, techniques, and procedures  can increase risk awareness and help senior leaders develop a better  understanding of the ongoing risk to organizational operations and  assets. If the agencies are unable to consistently receive quality, timely  data from their entire organizations, they will continue to be challenged in making effective decisions to address organization-wide cybersecurity  risks.

Sixteen of 23 civilian CFO Act agencies reported the lack of sufficiency,  clarity, or usefulness of NIST and/or OMB guidance for cybersecurity risk  management as a challenge. Six agencies stated that there was a lack of  practical instruction to assist agencies in implementing guidance. Six  agencies also stated that various guidance documents are not always  consistent or easy to understand. Six agencies also expressed a need for  guidance to address new technologies or emerging areas such as the use  of cloud providers or establishing cybersecurity risk management  programs at all levels of an organization. For example:

HHS’s  Acting Deputy CISO stated that, for all the positive aspects of  the NIST guidance, there is a lack of a centralized document or road  map that ties all the documents together from a cybersecurity  standpoint. Also, the official stated that the guidance from NIST  provides limited direction for producing specific metrics and checklists  in support of laws, policies, directives, instructions, and standards.

Transportation’s CISO stated that current guidance does not always  provide agencies with practical ways to implement requirements. For  example, the official noted that current OMB guidance on cyber and  privacy risk management does not tell agencies how to practically  integrate these disciplines, and that frequent updates to NIST  guidance that agencies have to respond to might be better applied to  identifying practical implementations. The official added that a lack of  practical implementation guidance may lead to duplication of effort  and inconsistency of outcomes.

OMB and NIST play important roles in issuing policies, standards, and  guidelines for agencies’ cybersecurity risk management programs.  However, if agencies find guidance unclear or insufficient, they will be  challenged in implementing key cybersecurity risk management  requirements.

Developing a Strategy to Manage Cybersecurity Risks

Fifteen of the 23 CFO Act agencies reported challenges in developing an  agency-wide cybersecurity risk management strategy that includes a  statement of risk tolerance and how the agency will assess, respond to,  and monitor risks. Ten agencies stated that they faced challenges in  establishing an agency-wide risk tolerance statement, while five noted  that they faced challenges in implementing a strategy across the agency.  For example:

Education’s Audit Liaison Officer from its Office of the CIO noted that  it was a challenge to develop an enterprise-level statement of risk  tolerance and that currently risk tolerance decisions were made at the  system level by the authorizing official.

EPA’s CISO reported that it was challenge to establish an agency- wide statement of risk tolerance. This is because it was difficult to  determine such factors as how much the mission’s operation is worth,  how much information resources are worth, and how much negative  public perception of the agency costs in terms of money or resources.

NIST notes that framing risk through the creation of a cybersecurity risk  management strategy establishes a foundation for managing risk and  delineates the boundaries for risk-based decisions within an agency. If  agencies are challenged in developing cybersecurity risk management  strategies, they may be hindered in making consistent decisions for  identifying, assessing, and responding to cybersecurity risks.

Incorporating Cyber Risks into Enterprise Risk Management

Fourteen of the 23 civilian CFO Act agencies reported that incorporating  cyber risks into the enterprise risk management process was a challenge.  Nine of these agencies noted challenges related to coordination between  cybersecurity and ERM, such as establishing effective channels of  communication or developing vocabularies for discussing risk that were  understandable by all stakeholders. In addition, five agencies noted that  their ERM process was still maturing. For example:

GSA’s Associate Chief Information Officer for Enterprise Planning &  Governance stated that a process was implemented to assess cyber  risks as part of the formalized ERM process; however, this official  noted that additional work is still needed to align and incorporate other  regular cybersecurity risk management reporting processes and  communication channels into the broader ERM framework.

Treasury’s Enterprise Cybersecurity Risk Management Officer stated  that incorporating cyber risks into ERM is a challenge because  cybersecurity risk is not currently quantified in the same way as other  risks. The official expressed the need for a standard vocabulary for  discussing cyber alongside other risks, adding that this makes it very  challenging to integrate cybersecurity risk management into ERM.

OMB has stated that an effective enterprise risk management program  promotes a common understanding for recognizing and describing  potential risks that can impact an agency’s mission and the delivery of  services to the public. Such risks include strategic, market, cyber, legal,  reputational, political, and a broad range of operational risks.  If agencies  do not successfully integrate cyber risks into their ERM processes, they  may be hindered in making effective decisions about addressing  cybersecurity risks in the context of other risks and their potential impact  on agency missions.

OMB and DHS Took Steps to Improve Cybersecurity Risk Management; Current Initiatives Address Some but Not All Identified Challenges

In accordance with a recent executive order, OMB and DHS took steps to  assess agencies’ cybersecurity management capabilities. They also  identified core actions to be taken, in coordination with agencies, to  address cybersecurity risks across the executive branch. Accordingly,  OMB and DHS have several initiatives under way to address these risks,  and several of these initiatives should help address some of the  challenges in establishing cybersecurity risk management programs that  the agencies in our review identified. However, these initiatives do not  address other challenges identified by a majority of the agencies.

OMB and DHS Assessed Government-Wide Cybersecurity Risks and Identified Findings Related to Federal Cybersecurity

EO 13800 on Strengthening the Cybersecurity of Federal Networks and  Critical Infrastructure emphasizes the importance of reducing  cybersecurity risks while also providing exceptional service to the public.  The EO aligns with FISMA by holding agency heads accountable for  managing cybersecurity risks. Toward this end, it directed agency heads  to provide a risk management report to OMB and DHS that documented  the agency’s risk mitigation and acceptance choices as of May 2017 and  describe the agency’s action plan to implement the NIST cybersecurity  framework.

The EO required OMB and DHS to assess each agency’s risk  management report and OMB, in coordination with DHS, to develop and  deliver a risk determination report to the President on whether the risk  mitigation and acceptance choices set forth in the agencies’ reports were  appropriate and sufficient to manage the cybersecurity risk to the  executive branch as a whole. OMB’s and DHS’s report was also to  include an action plan to, among other things, adequately protect the executive branch, should the risk determination  identify insufficiencies in agencies’ risk mitigation and acceptance  choices; establish a regular process to reassess and, if appropriate, reissue  the determination and address future recurring and unmet budgetary  needs necessary to manage risk to the executive branch; and  if appropriate, clarify, reconcile, and reissue policies, standards, and  guidelines issued in furtherance of FISMA and the EO, and align them  with the NIST cybersecurity framework.

In May 2017, OMB issued guidance to agencies for implementing the  provisions in EO 13800 on managing cybersecurity risks.  This guidance  required agencies to, among other things, report on their cybersecurity  risk management capabilities using the metrics established for monitoring  FISMA implementation. OMB and DHS used the results of the agencies’  risk management reports and responses to the FISMA reporting metrics  to assess agencies’ capabilities and make risk determinations of  agencies’ performance (“high risk,” “at risk,” or “managing risk”). OMB  and DHS’s process included an assessment of 96 agencies across the  executive branch, including the 23 civilian CFO Act agencies in the scope  of our review.

In May 2018, OMB published the Federal Cybersecurity Risk  Determination Report and Action Plan, in which OMB and DHS  determined that 74 percent of the federal agencies participating in the risk  assessment process had cybersecurity programs that were either “at risk”  or “high risk.” The report identified four key findings and actions  necessary to address cybersecurity risks across the federal enterprise, as  summarized in table 6. The report also described OMB’s plans to work  with DHS and other federal entities to implement these actions and  reduce cybersecurity risks across the government.

OMB and DHS also established a process for reassessing and, if  necessary, reissuing the agency risk determinations. Specifically, OMB  and DHS use the metrics collected during the FISMA reporting process to  update each agency’s risk management assessment on an ongoing  basis. At a minimum, CFO Act agencies must update their metrics  quarterly. The quarterly risk management assessment process allows for  the monitoring of agency-level risks, and OMB issues guidance yearly  codifying this process. In addition, OMB staff stated that they plan to  incorporate the overall risk determination into the office’s annual FISMA  report to Congress, although they noted that this is subject to change.

Further, OMB and DHS took steps to align government-wide  cybersecurity guidance with the NIST cybersecurity framework. For  example, OMB and DHS, in coordination with the federal cybersecurity  community, updated the reporting guidance on CIO and Inspector  General FISMA metrics to align with the framework. The FISMA metrics  leverage the framework as a standard for managing and reducing  cybersecurity risks, and the metrics are aligned with the five main  functions of the framework to provide agencies with a comprehensive  structure for making more informed, risk-based decisions, managing  cybersecurity risks across their enterprise, and providing a view of  agencies’ capabilities and potential gaps.

OMB and DHS Have Several Initiatives Under Way That Can Help Address Some, but Not All, Agency-Identified Challenges

OMB and DHS have several initiatives under way—some of them also  outlined in OMB’s federal cybersecurity report—that can assist agencies  in meeting challenges related to hiring and retaining cybersecurity risk  management personnel, establishing standardized IT capabilities,  receiving quality data, and using NIST and OMB guidance.

Workforce education initiatives: In November 2018, OMB  announced the launch of the Federal Cyber Reskilling Academy pilot  program, which is being sponsored by the CIO Council.  This  program offers current federal employees who do not work in the IT  field the opportunity for hands-on training in cybersecurity for 3  months to help them build foundational skills in cyber defense  analysis. In addition, the National Initiative for Cybersecurity Careers  and Studies is an online resource for cybersecurity training managed  by DHS that connects government employees, students, educators,  and industry with cybersecurity training providers throughout the  nation. The initiative’s Federal Virtual Training Environment, for  example, is an on-demand cybersecurity training system that contains  more than 800 hours of training on a variety of topics, including risk  management.

These initiatives, if effectively implemented, could help address  challenges agencies identified in hiring and retaining cybersecurity  risk management personnel. Specifically, the Cyber Reskilling  Academy has the potential to increase the pool of federal employees  with skills that agencies need for cyber risk management. In addition,  the Federal Virtual Training Environment can enhance federal  employees’ knowledge of and skills in cybersecurity risk management.

Continuous Diagnostics and Monitoring (CDM): DHS’s CDM  initiative is to provide federal agencies with tools and services that  have the intended capability to automate network monitoring,  correlate and analyze security-related information, and enhance risk- based decision making at agency and government-wide levels. These  tools include sensors that perform automated scans or searches for  known cyber vulnerabilities, the results of which can feed into a  dashboard that, at an agency level, is intended to alert network  managers and enable the agency to allocate resources based on the  risk. Summary data from each participating agency’s dashboard is  expected to be transmitted to the Federal Dashboard, where the data  can be used to inform decisions about cybersecurity risks across the  federal government. A DHS CDM program official stated that the  department plans to continue to deploy capabilities in fiscal year 2019  for asset management, identity and access management, and  monitoring network controls and activity.

The CDM initiative, if effectively implemented, has the potential to  assist in addressing challenges agencies identified in establishing  standardized IT capabilities for cybersecurity risk management and  improving the quality of data to provide visibility into cyber risks. In  particular, the tools and services offered through the program can  provide agencies with standardized capabilities for collecting and  analyzing cyber risk information. In addition, automated network  monitoring and analysis can help agencies that currently must  manually collect data from components based on self-reporting. Such  data may be less timely and accurate than those collected through the  tools available through CDM.

Security operations center (SOC) consolidation and maturation:  A SOC defends an organization against unauthorized activity within  computer networks, including, at a minimum, detecting, monitoring,  and analyzing suspicious activity. According to OMB, CISOs report  that these centers do not communicate with each other and that they  hoard, rather than share, threat information and intelligence. SOC  consolidation focuses on centralizing information sharing across the  agency, which is intended to improve the data agencies receive to  provide visibility into cybersecurity risks. OMB and DHS are working  with agencies to assess and enhance the maturity of their SOCs and  streamline security operations across their enterprise. Specifically,  agencies are required to develop and submit a Cybersecurity  operations maturation plan to OMB and DHS by April 2019. Following  submission of the plan, agencies are then required to complete SOC  maturation, consolidation, or migration to a SOC-as-a-Service  provider by September 2020.

Similar to CDM, SOC consolidation and maturation initiatives may  help address challenges related to standardizing capabilities and  collecting quality data, while enhancing enterprise-wide visibility.  Consolidation can provide agencies with a standardized set of SOC  services, while maturation can increase the quality of data on risks by  establishing a baseline set of expected SOC capabilities for executive  branch agencies.

Cyber threat framework: OMB and DHS are developing and  disseminating a framework, working with the Department of Defense,  Office of the Director of National Intelligence, and the National  Security Agency, to enable consistent characterization and  categorization of cyber threat events. Specifically, the Cyber Threat  Framework provides a hierarchical, structured, transparent, and  repeatable methodology for characterizing adversarial activities in a  standardized way across the federal government. The framework and  the related methodology provide for a cybersecurity architecture  review that allows an agency to assess its cyber capabilities against  its actual threat environment. This includes a gap analysis to  determine where agencies may need to enhance their capabilities to  defend against key threats. To foster the adoption of the Cyber Threat  Framework across the government, DHS—in coordination with OMB  and the Department of Defense—intends to develop and implement a  solution that will be available for agencies to use by the end of  December 2019.

The Cyber Threat Framework, if effectively implemented by civilian  federal agencies, can also help address agency challenges related to  the quality of data about cyber risks. By providing a standardized  framework for understanding cyber threats, it is intended to assist  agencies to better identify and prioritize risks, as well as the gaps in  their capabilities for protecting against such threats.

Inter-agency cyber-focused working groups: In coordination with  DHS, OMB established CyberStat review sessions to assist agencies  in protecting their systems, networks, and data. Specifically, agency  cyber professionals, from the working level to the CIO, meet with DHS  subject matter experts to participate in working sessions throughout a  4- to 6-week period to overcome barriers to success in specific  cybersecurity programs. During a CyberStat review, DHS provides  agencies with guidance on best practices and connects them with  other subject matter experts who can provide advice on implementing  the NIST framework and cybersecurity risk management practices. In  addition, the federal CIO Council has recently issued the CISO  Handbook, which was created to educate and inform new and existing  CISOs about their role in federal cybersecurity. The council is the  principal interagency forum for improving agency practices related to  the use, sharing, and performance of federal information resources  and part of its governing principles are to adopt and share IT  management best practices and to manage risk and ensure privacy  and security. Within the CIO Council, the CISO Council is specifically  tasked with developing IT security policy and sharing best practices to  improve the cybersecurity posture of the United States. Among other  things, the CISO Handbook includes information on NIST’s  cybersecurity framework and how it can be leveraged in conjunction  with other NIST risk management publications.

CyberStat reviews and the federal CIO Council can provide channels  to help agencies in better understanding and implementing guidance  from NIST and OMB on cybersecurity risk management. By  connecting agencies with best practices and subject matter experts,  CyberStat sessions are intended to help agencies, for example, apply  the NIST framework and cyber risk management practices. In  addition, the CIO Council, through sharing of best practices and  issuing publications, can provide guidance on how to more effectively  implement federal cybersecurity risk management guidance.

Although the initiatives under way could address challenges related to  hiring and retaining cybersecurity risk management personnel, developing  standardized capabilities, acquiring quality data about cyber risks, and  using NIST and OMB guidance, the existing initiatives do not address  challenges related to managing competing priorities, establishing  consistent policies and procedures, incorporating cyber risks into  enterprise risk management, and developing an agency-wide strategy for  managing cybersecurity risks.

Managing competing priorities between cybersecurity and  operations: OMB staff stated that its newly developed risk-based  budgeting model could help agencies prioritize their cybersecurity  investments. This model is intended to tie agencies’ cybersecurity  spending to the FISMA metrics process in order to identify capability  and process gaps that pose risks to an agency. OMB plans to  disseminate the risk-based budgeting process to enable agency CIOs,  CISOs, and Chief Financial Officers to communicate cyber risks  effectively across their agencies and to budget strategically for cyber  capabilities that address the agency’s most critical cybersecurity  needs. OMB anticipates being able to provide agencies with additional  details surrounding this model in the cybersecurity section of its  upcoming fiscal year 2020 guidance to the President’s budget.

However, while this risk-based approach to cybersecurity budgeting  should help agencies prioritize their cybersecurity investments, it does  not address issues related to prioritizing between cybersecurity and  mission or operational needs. The agencies in our review highlighted  that mission or operational priorities can conflict with cybersecurity  requirements when, for example, components within an agency have  differing views about the relative importance of mission and  cybersecurity activities. These issues do not relate to prioritizing  investments in cybersecurity but to managing conflicts, or potential  conflicts, between cybersecurity and mission needs.

Implementing consistent cybersecurity risk management policies  and procedures: OMB staff stated that several of OMB’s and DHS’s  initiatives emphasize driving performance through centralized  visibility, authority, and reporting. For example, OMB staff stated CDM  is intended to establish agencies’ visibility across the enterprise, as  well as government-wide visibility. OMB staff stated the  implementation of provisions commonly referred to as the Federal  Information Technology Acquisition Reform Act is intended to  enhance the role and authority of agency CIOs, particularly with  respect to relationships with agency components and accountability  for IT costs, performance, and security. Additionally, OMB staff  stated the risk management assessment process established in  response to EO 13800 emphasizes centralized visibility, authority, and  reporting.

While these efforts could provide increased visibility and CIO  authority, they do not address factors identified by agencies that  affected their ability to implement consistent cybersecurity risk  management policies and procedures. These include differing views  among staff regarding the importance of risks, and frequent changes  in leadership, all of which, according to agencies, make consistency  difficult to achieve.

Incorporating cyber risks into ERM: While existing OMB guidance  requires agencies to establish ERM programs and NIST guidance  requires agencies to establish cybersecurity risk management  programs, this guidance does not address how these efforts should  be integrated or coordinated. For example, OMB A-123 outlines  agencies’ responsibilities for establishing an ERM capability but does  not specifically address how enterprise risk management should  incorporate cyber risks. In addition, NIST guidance on cybersecurity  risk management recognizes that cybersecurity can be an important  component of an organization’s overall risk management and states  that its information security risk management guidance should be  used as part of a more comprehensive ERM program. However, it  does not explicitly discuss how to integrate or coordinate  cybersecurity risk management and enterprise risk management.

Establishing a cybersecurity risk management strategy: OMB  noted that the cyber threat framework will provide a more tangible way  for agencies to identify and prioritize cyber risks. However, while this  framework will allow agencies to better identify and categorize threats  and the capabilities needed to counter them, it does not address key  aspects of risk framing such as establishing an agency-wide  statement of risk tolerance and acceptable risk mitigation strategies.  Several agencies noted that they struggled to define risk tolerance  and establish criteria for different risk responses that could provide a  consistent, agency-wide approach to risk management.

Without additional guidance or other processes to identify successful  approaches for addressing these challenges, agencies will continue to be  hindered in establishing programs for effectively managing their  cybersecurity risks.

Given the increasing number and sophistication of cyber threats facing  federal agencies, it is critical that agencies are well positioned to make  consistent, informed risk-based decisions in protecting their systems and  information against these threats. While all the agencies in our review  have taken steps to establish cybersecurity risk management programs,  they have not fully addressed key practices that are foundational to  effectively managing cybersecurity risks. In particular, without developing  an agency-wide cybersecurity risk management strategy, agencies may  lack a consistent approach to managing cybersecurity risks. In addition,  while agencies have documented policies and procedures that include  many key practices, gaps remain that may hinder their ability to ensure a  consistent implementation of risk-based practices. Further, without a  process for an agency-wide cybersecurity risk assessment, agencies may  be missing opportunities to identify risks that affect their entire  organization, and to implement solutions to address them. Finally,  establishing processes for coordinating cybersecurity risk information with  the entity responsible for enterprise risk management would help ensure  that cyber risks are being considered by senior leadership in the context  of other risks facing the agency.

This inconsistent establishment of cybersecurity risk management  practices can be partially attributed to challenges agencies identified in  establishing and implementing their cybersecurity risk management  programs. Specifically, agencies noted a variety of challenges such as  hiring qualified staff, competing priorities between cybersecurity and  mission needs, implementing consistent policies and procedures,  incorporating cyber risks into enterprise risk management processes, and  developing a cybersecurity risk management strategy. Addressing these  challenges will be an important step toward establishing more effective  cybersecurity risk management programs across the 23 agencies.

OMB and DHS have taken steps to carry out their responsibilities to  identify and address weaknesses across the executive branch, including  actions that would address many of the challenges identified by agencies.  However, without fully addressing challenges related to prioritization  between cybersecurity needs and mission priorities, implementing  consistent risk management policies and procedures, incorporating cyber  risks into enterprise risk management, and establishing a cybersecurity  risk management strategy, OMB and DHS are likely to be missing  opportunities to assist agencies in these key areas. Clarified or updated  guidance, along with sharing successful practices or lessons learned,  could help agencies more fully establish their cybersecurity risk  management capacity.

We are making the following recommendation to OMB:

The Director of OMB should, in coordination with the Secretary of  Homeland Security, establish guidance or other means to facilitate the  sharing of successful approaches for agencies to address challenges  in the areas of (1) managing competing priorities between  cybersecurity and operations, such as when operational needs appear  to conflict with cybersecurity requirements; (2) implementing  consistent cybersecurity risk management policies and procedures  across an agency; (3) incorporating cyber risks into enterprise risk  management, and (4) establishing agencies’ cybersecurity risk  management strategies. (Recommendation 1)

We are also making a total of 57 recommendations to the 23 civilian CFO  Act agencies in our review to fully address key practices in their  cybersecurity risk management policies and procedures. Appendix VII  contains these recommendations.

We requested comments on a draft of this report from OMB and the 23  civilian CFO Act agencies included in our review. All the agencies  provided responses, as further discussed.

In an email from the office’s GAO audit liaison on July 8, 2019, OMB did  not state whether it agreed or disagreed with our recommendations.  However, the office provided technical comments, which we incorporated  as appropriate.

Of the 23 civilian CFO Act agencies, 17 agencies (Education, Energy,  DHS, HUD, Interior, Labor, State, Transportation, VA, USAID, GSA,  NASA, NSF, NRC, OPM, SBA, and SSA) concurred with our  recommendations; one agency (HHS) partially concurred with our  recommendations;  three agencies (Commerce, Justice, and Treasury)  provided comments but did not state whether they agreed or disagreed  with our recommendations; and two agencies (Agriculture and EPA)  stated that they had no comments on the report. Multiple agencies also  provided technical comments, which we incorporated as appropriate.

The following 17 agencies concurred with our recommendations and, in  most cases, described steps planned or under way to address them:

The Department of Education provided written comments in which it  concurred with our recommendation and stated that the department  will continue its efforts to fully develop a cybersecurity risk  management strategy that includes the definition of risk tolerance and  acceptable risk response strategies. Education’s comments are  reprinted in appendix VIII.

The Department of Energy provided written comments in which it  concurred with our two recommendations and described steps and  time frames for addressing them. In one case, regarding our  recommendation to update the department’s policies to address  missing elements, Energy stated that, as of May 2019, it had already  completed an update of its policies to implement this  recommendation. We intend to follow up with the department and  obtain and assess evidence to determine its implementation of this  recommendation. Energy’s comments are reprinted in appendix IX.

In written comments, the Department of Homeland Security stated  that it was pleased that our report noted steps that DHS and OMB  have taken to improve agencies’ capabilities for managing cyber risks.  DHS also concurred with our two recommendations and described  steps it intends to take to address them, along with estimated  completion dates. DHS’s comments are reprinted in appendix XI. The  department also provided technical comments, which we have  incorporated as appropriate.

The Department of Housing and Urban Development provided written  comments in which it thanked GAO for the opportunity to review the  report and stated that it concurred with the recommendations. HUD’s  comments are reprinted in appendix XII.

The Department of the Interior provided written comments in which it  concurred with our three recommendations. Interior also described  planned steps to address the recommendations, such as developing a  cybersecurity risk management strategy that includes the key  elements and updating its policies. The department’s comments are  reprinted in appendix XIII.

In written comments, the Department of Labor concurred with our  recommendation. Labor stated that it intends to take necessary steps  to update the department’s policies. The department’s comments are  reprinted in appendix XIV.

The Department of State provided written comments in which it  concurred with our two recommendations. State also described steps  planned or under way to address the recommendations. For example,  State described ongoing policy updates to address control monitoring,  system-level risk assessments, and the use of risk assessments to  inform control tailoring. It also described ongoing steps to align its  cybersecurity risk management activities with its ERM governance  structure. State’s comments are reprinted in appendix XV.

The Department of Transportation’s Director of Audit Relations &  Program Improvement provided comments via email on June 25,  2019, which stated that the department concurs with the findings and  recommendations in the draft report.

The Department of Veterans Affairs provided written comments in  which it concurred with our four recommendations. VA also described  actions planned or under way to address the recommendations.  Regarding our recommendation to establish and document a process  for coordination between its cybersecurity and enterprise risk  management functions, the department stated that it had already  established such a process and requested closure of the  recommendation. We intend to follow up with the department and  obtain and assess evidence to determine if its actions fully address  our recommendation. VA’s comments are reprinted in appendix XVI.

The U.S. Agency for International Development provided written  comments in which it agreed with our two recommendations. USAID  also described steps it has planned or under way to address the  recommendations, such as amending its guidance to address an  organization-wide cybersecurity risk assessment. The agency’s  comments are reprinted in appendix XVII.

In written comments, the General Services Administration stated that  it appreciated the opportunity to review the report and concurred with  its findings. The agency added that it is implementing an action plan  to address the four recommendations. GSA’s comments are reprinted  in appendix XVIII.

The National Aeronautics and Space Administration provided written  comments in which it concurred with our two recommendations.  NASA also described planned steps to address the recommendations,  such as updating its policies and establishing a process for an  organization-wide cybersecurity risk assessment, along with  estimated completion dates. The agency’s comments are reprinted in  appendix XIX.

The National Science Foundation’s GAO liaison provided comments  via email on July 3, 2019, which stated that the agency concurred with  our recommendation and intends to update its cybersecurity risk  management strategy to address the missing elements.

The Nuclear Regulatory Commission provided written comments in  which it stated that the agency was in general agreement with the  findings and recommendations in our draft report. NRC’s comments  are reprinted in appendix XX.

The Office of Personnel Management provided written comments in  which it stated that it concurred with our two recommendations. OPM  also described planned steps to address the recommendations, such  as updating its policies and establishing a process for an organization- wide cybersecurity risk assessment. The agency’s comments are  reprinted in appendix XXI.

In written comments, the Small Business Administration concurred  with our three recommendations. SBA described steps planned or  under way to address the recommendations, such as updating its  cybersecurity risk management strategy and policies and establishing  a process for an organization-wide cybersecurity risk assessment,  along with estimated completion dates. The agency’s comments are  reprinted in appendix XXII.

In written comments, the Social Security Administration agreed with  our recommendation and described planned efforts to further integrate  its cybersecurity and enterprise risk management functions. SSA’s  comments are reprinted in appendix XXIII.

One agency—the Department of Health and Human Services—concurred  with three of our recommendations and partially concurred with one  recommendation. Specifically, HHS concurred with our recommendations  to develop a risk management strategy that includes key elements,  establish a process for conducting an agency-wide cybersecurity risk  assessment, and establish and document a process for coordination  between cybersecurity risk management and enterprise risk management  functions. Further, HHS described steps planned or under way to address  these recommendations.

Regarding our recommendation to update department policies to require  an organization-wide cybersecurity risk assessment and the use of risk  assessments to inform control tailoring, HHS stated that it concurred with  the first part of the recommendation, but did not concur with the second  part of the recommendation. Specifically, the department described steps  it has planned or under way to update its policies to require an  organization-wide risk assessment, in accordance with the first part of the  recommendation. With respect to the second part of the recommendation,  the department pointed to portions of its information security and privacy  policy that address the selection of security and privacy controls.

However, while these policy statements require adherence to NIST and  OMB standards for selecting security controls and require a rationale for  tailoring decisions, they do not specifically require the use of risk  assessments to inform the tailoring of security controls. As NIST states,  organizations apply the tailoring process to align the controls more closely  with the specific conditions within the organization and should use risk  assessments to inform and guide the tailoring process for organizational  information systems and environments of operation. Making this  requirement explicit in policy would help HHS  ensure that it is applying  the appropriate set of controls to its systems; thus, we maintain that our  recommendation is still warranted.

HHS’s  comments are reprinted in appendix X. The department also  provided technical comments, which we incorporated as appropriate.

We received technical comments via email from the GAO audit liaisons at  three agencies—the Department of Commerce (on June 21, 2019), the  Department of Justice (on July 8, 2019), and the Department of the  Treasury (on July 3, 2019). The agencies did not state whether they  agreed or disagreed with our recommendations. We incorporated their  technical comments as appropriate.

We received emails from Agriculture’s Director of Strategic Planning,  Egovernment and Audits on June 19, 2019, and from a Division Director  in the Environmental Protection Agency’s Office of Information Security  and Privacy on July 8, 2019, which stated that their agencies had no  comments on the draft report.

We are sending copies of this report to the appropriate congressional  committees, the heads of the agencies in our review, and other interested  parties. In addition, the report is available at no charge on the GAO  website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-9342 or marinosn@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix XXIV.

Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to examine  (1) the extent to which agencies established key elements of a  cybersecurity risk management program;  (2) what challenges, if any, agencies identified in developing and  implementing cybersecurity risk management programs; and  (3) what steps the Office of Management and Budget (OMB) and  Department of Homeland Security (DHS) have taken to meet their risk  management responsibilities under Executive Order (EO) 13800 and to  address any challenges agencies face in implementing cybersecurity risk  management practices.

In conducting this engagement, we focused on 23 of the 24 agencies  covered by the Chief Financial Officers Act of 1990.  To address our first  objective, we collected agency policies, procedures, and other  documentation and compared them to selected key practices from OMB  and National Institute of Standards and Technology (NIST) guidance for  cybersecurity risk management.

To identify the key practices, we reviewed OMB guidance pertaining to  cybersecurity risk management, including OMB Circular A-130: Managing  Information as a Strategic Resource, as well as Circular A-123:  Management’s Responsibility for Enterprise Risk Management and  Internal Control, which outlines agency responsibilities for enterprise risk management. We also reviewed NIST guidance, including the Framework  for Improving Critical Infrastructure Cybersecurity; Special Publication  800-30: Guide for Conducting Risk Assessments; Special Publication  800-37: Guide for Applying the Risk Management Framework to Federal  Information Systems, and Special Publication 800-39: Managing  Information Security Risk: Organization, Mission, and Information System  View. In selecting the key practices for our assessment, we focused on  those practices identified by OMB and NIST as foundational for providing  an organization-wide approach to cybersecurity risk management.

We collected and analyzed documentation and other information from  each agency related to cybersecurity risk management and compared it  to the identified key practices. We supplemented our analyses with  interviews with relevant agency officials to discuss the development of  their policies. We discussed the results of our initial analysis of agency  documentation with agency officials to validate our findings, collect  additional evidence, and identify causes for any gaps. We then  determined whether the evidence provided by the agency addressed  each identified criteria element. Specifically, for each criteria element, we  determined if the evidence fully addressed the element (“met”),  addressed some, but not all, aspects of the element (“partially met”), or  did not address any aspects of the element (“not met”).

To address the second objective, we administered structured interview  questions to the agencies to determine what challenges, if any, they face  in developing and implementing policies and procedures for managing cybersecurity risk. We developed a list of potential challenges based on  our assessment of agencies’ policies and procedures, a review of OMB’s  risk report on agencies’ cybersecurity risk management capabilities,  and  reviews of prior GAO reports in areas related to cybersecurity risk  management. We worked with GAO methodologists to develop a set of  structured interview questions that were sent to the agencies and asked  them to indicate if they faced each of these, as well as any additional,  challenges, and to provide specific examples. We received responses  from all 23 agencies in our review and analyzed them to identify those  challenges that were indicated by a majority of the agencies. We  excluded from our counts agencies that stated they did not have  challenges in a particular area. We also identified common themes within  the challenge areas.

To address the third objective, we reviewed EO 13800 and  implementation guidance issued by OMB,  as well as relevant reports  and other documents, including OMB’s Federal Cybersecurity Risk  Determination Report and Action Plan, OMB memos, and supporting  documentation for DHS initiatives. We also interviewed OMB and DHS  officials with government-wide cybersecurity responsibilities to gain an  understanding of initiatives under way to address their responsibilities  under the order, and that could help address challenges identified by the  agencies. We then compared these initiatives to the responses we  received from agencies to determine if there were any gaps between the  challenges and the ongoing initiatives. Specifically, for each challenge  identified by a majority of the agencies in our review, we determined if  any of the initiatives under way would address them based on a review of  documentation associated with the initiatives as well as discussions with  OMB and DHS officials.

We conducted this performance audit from February 2018 to July 2019 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: Details on the Extent to Which Agencies Established a Cybersecurity Risk Executive Function

Twenty-two of the 23 civilian Chief Financial Officers Act agencies in our  review established and documented the role of the cybersecurity risk  executive. Agencies varied in assigning this responsibility to the chief  information officer (CIO), chief information security officer (CISO), or  another official or entity. Table 7 provides details on our assessment.

Appendix III: Details on the Extent to Which Agencies Developed a Cybersecurity Risk Management Strategy

Of the 23 civilian Chief Financial Officers Act agencies, seven fully  established a cybersecurity risk management strategy that included key  elements recommended by National Institute of Standards and  Technology (NIST) guidance. Specifically, these seven agencies  developed strategies to guide how cybersecurity risk is to be framed,  assessed, responded to, and monitored. In addition, five of the 23  agencies partially developed a cybersecurity risk management strategy,  but their strategies did not address certain required elements. The  remaining 11 agencies did not develop an agency-wide cybersecurity risk  management strategy. Table 8 provides details on our assessment.

Appendix IV: Details on the Extent to Which Agencies Developed Risk-Based Policies and Procedures

The following elements, identified in NIST guidance,  should be  addressed in policies and procedures to facilitate risk-based decision  making in securing information systems and data.

Most of the 23 civilian Chief Financial Officers Act agencies addressed  the majority of the key practices for incorporating risk-based decision- making in their policies and procedures. However, most of the agencies  also had gaps in one or more of these areas. Specifically, six agencies  addressed all the elements in their policies and procedures, and the  remaining 17 were missing at least one. Table 10 provides details on our  assessment of the agencies’ policies.

Appendix V: Details on the Extent to Which Agencies Developed an Organization-Wide Cybersecurity Risk Assessment

Of the 23 civilian Chief Financial Officers Act agencies, 12 developed a  process for an agency-wide cybersecurity risk assessment. Specifically,  these agencies developed processes for aggregating system-level data  and analyzing them to assess overall cybersecurity risk to agency  operations and assets. The remaining 11 agencies did not establish such  a process. Table 11 provides details on our assessment.

Appendix VI: Details on Agencies’ Processes for Coordination between Cybersecurity and Enterprise Risk Management

Of the 23 civilian Chief Financial Officers Act agencies, 10 fully  established a process or mechanism for coordination between their  cybersecurity risk executive and their enterprise risk management (ERM)  governance structure, five agencies partially established such a process,  and the remaining eight agencies did not provide evidence of  coordination. Table 12 provides details on our assessment.

Appendix VII: Recommendations to Departments and Agencies

We are making a total of 57 recommendations to the 23 civilian Chief  Financial Officers Act agencies in our review to fully address key  practices in their cybersecurity risk management policies and procedures.

The Secretary of Agriculture should take the following three actions:

Develop a cybersecurity risk management strategy that includes the  key elements identified in this report. (Recommendation 2)

Update the department’s policies to require (1) the use of risk  assessments to inform security control tailoring and (2) the use of risk  assessments to inform plan of actions and milestones (POA&M)  prioritization. (Recommendation 3)

Establish and document a process for coordination between  cybersecurity risk management and enterprise risk management  functions. (Recommendation 4)

The Secretary of Commerce should take the following two actions:

Update the department’s policies to require (1) an organization-wide  cybersecurity risk assessment and (2) the use of risk assessments to  inform POA&M prioritization. (Recommendation 5)

Establish a process for conducting an organization-wide cybersecurity  risk assessment. (Recommendation 6)

The Secretary of Education should take the following action:

Fully develop a cybersecurity risk management strategy that includes  the key elements identified in this report. (Recommendation 7)

The Secretary of Energy should take the following two actions:

Develop a cybersecurity risk management strategy that includes the  key elements identified in this report. (Recommendation 8)

Update the department’s policies to require (1) an organization-wide  cybersecurity risk assessment and (2) the identification of common  controls. (Recommendation 9)

The Secretary of Health and Human Services should take the following  four actions:

Develop a cybersecurity risk management strategy that includes the  key elements identified in this report. (Recommendation 10)

Update the department’s policies to require (1) an organization-wide  cybersecurity risk assessment and (2) the use of risk assessments to  inform security control tailoring. (Recommendation 11)

Establish a process for conducting an organization-wide cybersecurity  risk assessment. (Recommendation 12)

Establish and document a process for coordination between  cybersecurity risk management and enterprise risk management  functions. (Recommendation 13)

The Secretary of Homeland Security should take the following two  actions:

Develop a cybersecurity risk management strategy that includes the  key elements identified in this report. (Recommendation 14)

Establish and document a process for coordination between  cybersecurity risk management and enterprise risk management  functions. (Recommendation 15)

The Secretary of Housing and Urban Developing should take the  following two actions:

Develop a cybersecurity risk management strategy that includes the  key elements identified in this report. (Recommendation 16)

Update the department’s policies to require the use of risk  assessments to inform POA&M prioritization. (Recommendation 17)

The Secretary of the Interior should take the following three actions:

Develop a cybersecurity risk management strategy that includes the  key elements identified in this report. (Recommendation 18)

Update the department’s policies to require an organization-wide  cybersecurity risk assessment. (Recommendation 19)

Establish and document a process for coordination between  cybersecurity risk management and enterprise risk management  functions. (Recommendation 20)

The Attorney General should take the following two actions:

Develop a cybersecurity risk management strategy that includes the  key elements identified in this report. (Recommendation 21)

Fully establish and document a process for coordination between  cybersecurity risk management and enterprise risk management  functions. (Recommendation 22)

The Secretary of Labor should take the following action:

Update the department’s policies to require (1) the use of risk  assessments to inform control tailoring and (2) the use of risk  assessments to inform POA&M prioritization. (Recommendation 23)

The Secretary of State should take the following two actions:

Update the department’s policies to require (1) an organization-wide  risk assessment, (2) an organization-wide strategy for monitoring  control effectiveness, (3) system-level risk assessments, (4) the use  of risk assessments to inform security control tailoring, and (5) the use  of risk assessments to inform POA&M prioritization.  (Recommendation 24)

Establish and document a process for coordination between  cybersecurity risk management and enterprise risk management  functions. (Recommendation 25)

The Secretary of Transportation should take the following three actions:

Fully develop a cybersecurity risk management strategy that includes  the key elements identified in this report. (Recommendation 26)

Update the department’s policies to require an organization-wide risk  assessment. (Recommendation 27)

Fully establish and document a process for coordination between  cybersecurity risk management and enterprise risk management  functions. (Recommendation 28)

The Secretary of the Treasury should take the following three actions:

Develop a cybersecurity risk management strategy that includes the  key elements identified in this report. (Recommendation 29)

Establish a process for conducting an organization-wide cybersecurity  risk assessment. (Recommendation 30)

Establish and document a process for coordination between  cybersecurity risk management and enterprise risk management  functions. (Recommendation 31)

The Secretary of Veterans Affairs should take the following four actions:

Develop a cybersecurity risk management strategy that includes the  key elements identified in this report. (Recommendation 32)

Update the department’s policies to require an organization-wide  cybersecurity risk assessment. (Recommendation 33)

Establish a process for conducting an organization-wide cybersecurity  risk assessment. (Recommendation 34)

Establish and document a process for coordination between  cybersecurity risk management and enterprise risk management  functions. (Recommendation 35)

The Administrator of USAID should take the following two actions:

Update the agency’s policies to require (1) an organization-wide  cybersecurity risk assessment and (2) the use of risk assessments to  inform control tailoring. (Recommendation 36)

Establish a process for conducting an organization-wide cybersecurity  risk assessment. (Recommendation 37)

The Administrator of EPA should take the following four actions:

Fully develop a cybersecurity risk management strategy that includes  the key elements identified in this report. (Recommendation 38)

Update the agency’s policies to require an organization-wide  cybersecurity risk assessment. (Recommendation 39)

Establish a process for conducting an organization-wide cybersecurity  risk assessment. (Recommendation 40)

Fully establish and document a process for coordination between  cybersecurity risk management and enterprise risk management  functions. (Recommendation 41)

The Administrator of General Services should take the following four  actions:

Designate and document a risk executive function with responsibilities  for organization-wide cybersecurity risk management.  (Recommendation 42)

Update the agency’s policies to require an organization-wide  cybersecurity risk assessment. (Recommendation 43)

Establish a process for conducting an organization-wide cybersecurity  risk assessment. (Recommendation 44)

Fully establish and document a process for coordination between  cybersecurity risk management and enterprise risk management  functions. (Recommendation 45)

The Administrator of NASA should take the following two actions:

Update the agency’s policies to require (1) an organization-wide risk  assessment and (2) the use of risk assessments to inform POA&M  prioritization. (Recommendation 46)

Establish a process for conducting an organization-wide cybersecurity  risk assessment. (Recommendation 47)

We are not making a recommendation to NASA to establish a  cybersecurity risk management strategy because we previously made  such a recommendation, which remains open.

The Director of NSF should take the following action:

Fully develop a cybersecurity risk management strategy that includes  the key elements identified in this report. (Recommendation 48)

The Chairman of NRC should take the following four actions:

Develop a cybersecurity risk management strategy that includes the  key elements identified in this report. (Recommendation 49)

Update the agency’s policies to require (1) an organization-wide  cybersecurity risk assessment and (2) the use of risk assessments to  inform POA&M prioritization. (Recommendation 50)

Establish a process for conducting an organization-wide cybersecurity  risk assessment. (Recommendation 51)

Establish and document a process for coordination between  cybersecurity risk management and enterprise risk management  functions. (Recommendation 52)

The Director of OPM should take the following two actions:

Update the agency’s policies to require (1) an organization-wide  cybersecurity risk assessment and (2) the use of risk assessments to  inform control tailoring. (Recommendation 53)

Establish a process for conducting an organization-wide cybersecurity  risk assessment. (Recommendation 54)

The Administrator of SBA should take the following three actions:

Fully develop a cybersecurity risk management strategy that includes  the key elements identified in this report. (Recommendation 55)

Update the agency’s policies to require (1) an organization-wide  cybersecurity risk assessment and (2) the use of risk assessments to  inform POA&M prioritization. (Recommendation 56)

Establish a process for conducting an organization-wide cybersecurity  risk assessment. (Recommendation 57)

The Commissioner of SSA should take the following action:

Fully establish and document a process for coordination between  cybersecurity risk management and enterprise risk management  functions. (Recommendation 58)

Appendix VIII: Comments from the Department of Education

Appendix IX: Comments from the Department of Energy

Appendix X: Comments from the Department of Health and Human Services

Appendix XI: Comments from the Department of Homeland Security

Appendix XII: Comments from the Department of Housing and Urban Development

Appendix XIII: Comments from the Department of the Interior

Appendix XIV: Comments from the Department of Labor

Appendix XV: Comments from the Department of State

Appendix XVI: Comments from the Department of Veterans Affairs

Appendix XVII: Comments from the U.S. Agency for International Development

Appendix XVIII: Comments from the General Services Administration

Appendix XIX: Comments from the National Aeronautics and Space Administration

Appendix XX: Comments from the Nuclear Regulatory Commission

Appendix XXI: Comments from the Office of Personnel Management

Appendix XXII: Comments from the Small Business Administration

Appendix XXIII: Comments from the Social Security Administration

Appendix XXIV: GAO Contact and Staff Acknowledgments

In addition to the individual named above, Marisol Cruz Cain (assistant  director), Lee McCracken (analyst in charge), Kiana Beshir, Roger Bracy,  Chris Businsky, Alan Daigle, John de Ferrari, Nancy Glover, Franklin  Jackson, Vernetta Marquis, Carlton Maynard, Scott Pettis, Tomas  Ramirez, Andrew Stavisky, and Shaunyce Wallace made significant  contributions to this report.

To protect against cyber threats, federal agencies should incorporate key practices in their cybersecurity risk management programs.

Designating a cybersecurity risk executive

Developing a risk management strategy and policies

Coordinating between cybersecurity and enterprise-wide risk management functions

All but one of the 23 agencies we reviewed designated a risk executive. However, none of these agencies fully incorporated the other key practices into their programs.

We made 58 recommendations to federal agencies to help improve their cybersecurity risk management programs.