The agencies and ISACs selected for our review were specifically requested  by the House Committee on Energy and Commerce as consistent with its  jurisdiction for specific agencies and for the industry sectors for which  these agencies have responsibilities. We performed this work at the four  agencies—HHS, Energy, Commerce, and EPA—and for the five ISACs  associated with key sectors of our economy—telecommunications,  information technology, electricity, oil and gas energy, and water supply. PDD 63 called for a range of actions  intended to improve federal agency security programs, improve the  nation’s ability to detect and respond to serious computer-based and  physical attacks, and establish a partnership between the government and  the private sector. The National Strategy to Secure Cyberspace is intended to provide an  initial framework for both organizing and prioritizing efforts to protect our  nation’s cyberspace. However, over 4 years after  PDD 63 was issued, the agencies have not completed the fundamental  processes of identifying their critical assets and their dependencies on  other public- and private-sector assets. ISACs’ Progress in Implementing PDD 63- Suggested Activities Is Mixed

In addition to specific requirements for federal agencies, PDD 63  encouraged the voluntary creation of ISACs and suggested other activities  for them to undertake in order to effectively gather, analyze, and  disseminate information to and from infrastructure sectors and the federal  government. Serving as a clearinghouse for information within and among the  various sectors. Three reported that although they maintain such a  library, it is available only to the private sector because of concerns that, if  made available to the government, the information could be released under  the Freedom of Information Act (FOIA). Our analyses also identified an external coordination challenge with GSA,  which may often be responsible for protecting agency facilities or buildings  that house critical assets. The five ISACs have made progress in establishing ISAC operations. Recommendations for Executive Action

To (1) help ensure the identification and adequate protection of critical  agency cyber-based and physical assets and (2) reinforce management’s  commitment to prioritize the protection of critical infrastructure  throughout agencies, we recommend that the Secretaries of Commerce,  Energy, and Health and Human Services and the Administrator of the  Environmental Protection Agency all direct their respective CIOs and chief  infrastructure assurance officers to work together, as appropriate, to:  coordinate with CIAO to set milestones to complete their Project Matrix  analyses that will identify each agency’s critical cyber, physical, and  other assets and the dependencies of these assets on other government  operations and privately owned critical infrastructures;   require, concurrently with the identification of critical assets and their  dependencies, that vulnerability assessments be conducted or updated  where warranted, to appropriately consider (1) the specific assets  identified as critical national assets and their dependencies, (2) both  cyber and physical vulnerabilities of these assets, and (3) changes in the  threat environment, particularly as reflected by recent terrorist activity  and in warnings by the Office of Homeland Security and NIPC;   ensure that remediation plans for correcting identified critical asset  vulnerabilities are developed, specifying corrective actions and the time  lines, responsibilities, and funding for their implementation; and that  cyber-related actions are also reflected in the agency’s information  security corrective-action plans, and that updates are reported to OMB;  ensure that agency continuity-of-operations plans are prepared or  updated to incorporate critical assets and, according to the CIAO  criterion, that they provide for the reconstitution of these assets within  72 hours of a successful infrastructure attack or disruption;   routinely track and monitor the status of vulnerability assessments,  corrective actions, and other security efforts related to critical assets,  such as the development of continuity-of-operations plans; and provide  an annual status update to help support budget requests and other  reporting requirements, such as those of the Government Performance  and Results Act and the Federal Information Security Management Act;   formally apprise the General Services Administration when facilities or  buildings for which it has protective responsibilities house agency- critical assets identified through the Project Matrix process; and   use Project Matrix plans and results to help prioritize and prepare  budget justifications for resources needed to identify and protect the  agency’s own critical infrastructures.
Why GAO Did This Study

The explosive growth of computer interconnectivity is transforming the workings of our nation, its government, and its critical infrastructures. But with the enormous benefits of this interconnectivity comes a threat: both physical and cyber assets are potentially vulnerable to computer-based attack. In response, Presidential Decision Directive 63 (PDD 63, May 1998) called for a range of actions to improve the nation's ability to detect and respond to serious infrastructure attacks. For specific agencies under the Committee on Energy and Commerce's jurisdiction and for private-sector organizations for which these agencies have responsibilities, GAO was asked, among other things, to assess their progress and challenges in undertaking critical infrastructure protection (CIP) activities.

What GAO Found

Federal efforts to protect our nation's critical public and private infrastructures have had mixed progress. GAO examined four specific agencies--the Departments of Health and Human Services (HHS), Energy, and Commerce, and the Environmental Protection Agency (EPA)--and found that the agencies have made progress in implementing several PDD 63 requirements, such as appointing chief information assurance officers and preparing initial CIP plans. However, none of the agencies has fully implemented all requirements, including the fundamental processes of identifying agency assets that are critical to the nation and determining their dependencies on other public and private assets, as well as assessing these assets' vulnerabilities. In addition, although most agencies have tentatively identified their critical assets, these efforts could take years to complete given the current pace and estimated time and resource needs. GAO also examined private-sector groups known as Information Sharing and Analysis Centers (ISACs) for five specific industry sectors--information technology, telecommunications, energy, electricity, and water supply. PDD 63 suggested voluntary ISAC creation to, among other things, serve as mechanisms for information sharing between infrastructure sectors and the government. In response, ISACs have been established and are serving as clearinghouses for their sectors to share information. For other suggested activities, such as establishing baseline statistics on computer security incidents, progress is mixed. Both the agencies and the ISACs identified challenges and obstacles to undertaking CIP activities. Agency-identified challenges included coordinating security efforts for critical assets with the General Services Administration, which may often be responsible for protecting agency facilities that house critical assets. The ISACs identified obstacles to information sharing, both between the sectors and the government and within the sectors. In particular, they noted concerns that information reported to the government could be subject to public release under the Freedom of Information Act.