Ineffective protection of these information systems and networks can  result in a failure to deliver these vital services, and result in  loss or theft of computer resources, assets, and funds;  inappropriate access to and disclosure, modification, or destruction of  sensitive information, such as national security information, PII, and  proprietary business information; disruption of essential operations supporting critical infrastructure,  national defense, or emergency services; undermining of agency missions due to embarrassing incidents that  erode the public’s confidence in government; use of computer resources for unauthorized purposes or to launch  attacks on other systems; damage to networks and equipment; and high costs for remediation. Federal Agencies Face Ongoing Cybersecurity Challenges

Given the risks posed by cyber threats and the increasing number of  incidents, it is crucial that federal agencies take appropriate steps to  secure their systems and information. We and agency inspectors general  have identified challenges in protecting federal information and systems,  including those in the following key areas:
Designing and implementing risk-based cybersecurity programs  at federal agencies. 2.) GAO and agency inspectors general have made hundreds of  recommendations to agencies aimed at improving their  implementation of these information security controls. Enhancing oversight of contractors providing IT services. Improving security incident response activities. Responding to breaches of PII. Implementing security programs at small agencies. DHS  has implemented this recommendation. Until federal agencies take actions to address these challenges— including implementing the hundreds of recommendations we and  inspectors general have made—federal systems and information will be  at an increased risk of compromise from cyber-based attacks and other  threats. Government-Wide Cybersecurity Initiatives Present Potential Benefits and Challenges

In addition to the efforts of individual agencies, DHS and OMB have  several initiatives under way to enhance cybersecurity across the federal  government. Personal Identity Verification: In August 2004, Homeland Security  Presidential Directive 12 ordered the establishment of a mandatory,  government-wide standard for secure and reliable forms of identification  for federal government employees and contractor personnel who access  government-controlled facilities and information systems. Subsequently,  the National Institute of Standards and Technology (NIST) defined  requirements for such personal identity verification (PIV) credentials  based on “smart cards”—plastic cards with integrated circuit chips to  store and process data—and OMB directed federal agencies to issue and  use PIV credentials to control access to federal facilities and systems. In February 2015, OMB  reported that, as of the end of fiscal year 2014, only 41 percent of agency  user accounts at the 23 civilian CFO Act agencies required PIV cards for  accessing agency systems. Continuous Diagnostics and Mitigation (CDM): According to DHS, this  program is intended to provide federal departments and agencies with  capabilities and tools that identify cybersecurity risks on an ongoing basis,  prioritize these risks based on potential impacts, and enable cybersecurity  personnel to mitigate the most significant problems first. DHS, in partnership with the General  Services Administration, has established a government-wide contract that  is intended to allow federal agencies (as well as state, local, and tribal  governmental agencies) to acquire CDM tools at discounted rates. We made several recommendations to improve the  implementation of the iPost program, and State partially agreed. The  EINSTEIN capabilities of NCPS are described in table 1. Our final report is expected to be released later this year, and our  preliminary observations include the following:
DHS appears to have developed and deployed aspects of the  intrusion detection and intrusion prevention capabilities, but potential  weaknesses may limit their ability to detect and prevent computer  intrusions. The intrusion prevention  In conclusion, the danger posed by the wide array of cyber threats facing  the nation is heightened by weaknesses in the federal government’s  approach to protecting its systems and information. While recent  government-wide initiatives hold promise for bolstering the federal  cybersecurity posture, it is important to note that no single technology or  set of practices is sufficient to protect against all these threats. A “defense  in depth” strategy is required that includes well-trained personnel,  effective and consistently applied processes, and appropriately  implemented technologies.
Why GAO Did This Study

Effective cybersecurity for federal information systems is essential to preventing the loss of resources, the compromise of sensitive information, and the disruption of government operations. Federal information and systems face an evolving array of cyber-based threats, and recent data breaches at federal agencies highlight the impact that can result from ineffective security controls.
Since 1997, GAO has designated federal information security as a government-wide high-risk area, and in 2003 expanded this area to include computerized systems supporting the nation's critical infrastructure. This year, in GAO's high-risk update, the area was further expanded to include protecting the privacy of personal information that is collected, maintained, and shared by both federal and nonfederal entities.
This statement summarizes (1) challenges facing federal agencies in securing their systems and information and (2) government-wide initiatives, including those led by DHS, aimed at improving cybersecurity. In preparing this statement, GAO relied on its previously published and ongoing work in this area.

What GAO Found

GAO has identified a number of challenges federal agencies face in addressing threats to their cybersecurity, including the following:
Designing and implementing a risk-based cybersecurity program.
Enhancing oversight of contractors providing IT services.
Improving security incident response activities.
Responding to breaches of personal information.
Implementing cybersecurity programs at small agencies.
Until federal agencies take actions to address these challenges—including implementing the hundreds of recommendations GAO and agency inspectors general have made—federal systems and information, including sensitive personal information, will be at an increased risk of compromise from cyber-based attacks and other threats.
In an effort to bolster cybersecurity across the federal government, several government-wide initiatives, spearheaded by the Department of Homeland Security (DHS) and the Office of Management and Budget (OMB), are under way. These include the following:
Personal Identity Verification: In 2004, the President directed the establishment of a government-wide standard for secure and reliable forms of ID for federal employees and contractor personnel who access government facilities and systems. Subsequently, OMB directed agencies to issue personal identity verification credentials to control access to federal facilities and systems. OMB recently reported that only 41 percent of user accounts at 23 civilian agencies had required these credentials for accessing agency systems.
Continuous Diagnostics and Mitigation: DHS, in collaboration with the General Services Administration, has established a government-wide contract for agencies to purchase tools that are intended to identify cybersecurity risks on an ongoing basis. These tools can support agencies' efforts to monitor their networks for security vulnerabilities and generate prioritized alerts to enable agency staff to mitigate the most critical weaknesses. The Department of State adopted a continuous monitoring program, and in 2011 GAO reported on the benefits of the program and challenges the department faced in implementing its approach.
National Cybersecurity Protection System (NCPS): This system, also referred to as EINSTEIN, is to include capabilities for monitoring network traffic and detecting and preventing intrusions, among other things. GAO has ongoing work reviewing the implementation of NCPS, and preliminary observations indicate that implementation of the intrusion detection and prevention capabilities may be limited and DHS appears to have not fully defined requirements for future capabilities.
While these initiatives are intended to improve security, no single technology or tool is sufficient to protect against all cyber threats. Rather, agencies need to employ a multi-layered, “defense in depth” approach to security that includes well-trained personnel, effective and consistently applied processes, and appropriate technologies.

What GAO Recommends

In previous work, GAO and agency inspectors general have made hundreds of recommendations to assist agencies in addressing cybersecurity challenges. GAO has also made recommendations to improve government-wide initiatives.