The law establishes DHS’s  responsibilities for critical infrastructure protection, a role that includes  strengthening the security of our nation’s information infrastructure. NCSD also serves as the government lead on a public/private partnership  supporting the U.S. Computer Emergency Response Team (US-CERT) and  as the lead for federal government incident response. However, DHS has not yet  developed national cyber threat and vulnerability assessments or  developed and exercised government and government/industry  contingency recovery plans for cybersecurity, including a plan for  recovering key Internet functions. DHS Continues to Face Challenges in Establishing Itself as a National Focal Point for Cyberspace Security

DHS faces a number of challenges that have impeded its ability to fulfill its  cyber CIP responsibilities. Key challenges include achieving organizational  stability; gaining organizational authority; overcoming hiring and  contracting issues; increasing awareness about cybersecurity roles and  capabilities; establishing effective partnerships with stakeholders (other  federal, state, and local governments and the private sector); achieving  two-way information sharing with these stakeholders; and providing and  demonstrating the value DHS can provide. DHS has identified steps in its strategic plan for cybersecurity that can  begin to address these challenges. Recommendations for Executive Action

In order to improve DHS’s ability to fulfill its mission as an effective focal  point for cybersecurity, we recommend that the Secretary of Homeland  Security implement the following three steps:  engage appropriate stakeholders to prioritize key cybersecurity  responsibilities so that the most important activities are addressed first,  including responsibilities that are not detailed in the cybersecurity  strategic plan: (1) perform a national cyber threat assessment;  (2) facilitate sector cyber vulnerability assessments—to include  identification of cross-sector interdependencies; and (3) establish  contingency plans for cybersecurity, including recovery plans for key  Internet functions;  require NCSD to develop a prioritized list of key activities for addressing  the underlying challenges that are impeding execution of its  responsibilities; and  identify performance measures and milestones for fulfilling its  prioritized responsibilities and for performing activities to address its  challenges, and track organizational progress against these measures  and milestones. Objectives, Scope, and Methodology

Our objectives were to determine (1) the Department of Homeland  Security’s (DHS) roles and responsibilities for cyber critical infrastructure  protection (CIP) and national information security, as established in law  and policy, and determine the specific organizational structures DHS has  created to fulfill them; (2) the status of DHS’s efforts to protect the  computer systems supporting the nation’s critical infrastructures and to  strengthen information security both inside and outside the federal  government and the extent to which such efforts and DHS’s organizational  structures adequately address its responsibilities; and (3) the challenges  DHS faces in fulfilling its cybersecurity roles and responsibilities.
Why GAO Did This Study

Increasing computer interconnectivity has revolutionized the way that our government, our nation, and much of the world communicate and conduct business. While the benefits have been enormous, this widespread interconnectivity also poses significant risks to our nation's computer systems and, more importantly, to the critical operations and infrastructures they support. The Homeland Security Act of 2002 and federal policy established DHS as the focal point for coordinating activities to protect the computer systems that support our nation's critical infrastructures. GAO was asked to determine (1) DHS's roles and responsibilities for cyber critical infrastructure protection, (2) the status and adequacy of DHS's efforts to fulfill these responsibilities, and (3) the challenges DHS faces in fulfilling its cybersecurity responsibilities.

What GAO Found

As the focal point for critical infrastructure protection (CIP), the Department of Homeland Security (DHS) has many cybersecurity-related roles and responsibilities that we identified in law and policy. DHS established the National Cyber Security Division to take the lead in addressing the cybersecurity of critical infrastructures. While DHS has initiated multiple efforts to fulfill its responsibilities, it has not fully addressed any of the 13 responsibilities, and much work remains ahead. For example, the department established the United States Computer Emergency Readiness Team as a public/private partnership to make cybersecurity a coordinated national effort, and it established forums to build greater trust and information sharing among federal officials with information security responsibilities and law enforcement entities. However, DHS has not yet developed national cyber threat and vulnerability assessments or government/industry contingency recovery plans for cybersecurity, including a plan for recovering key Internet functions. DHS faces a number of challenges that have impeded its ability to fulfill its cyber CIP responsibilities. These key challenges include achieving organizational stability, gaining organizational authority, overcoming hiring and contracting issues, increasing awareness about cybersecurity roles and capabilities, establishing effective partnerships with stakeholders, achieving two-way information sharing with these stakeholders, and demonstrating the value DHS can provide. In its strategic plan for cybersecurity, DHS identifies steps that can begin to address the challenges. However, until it confronts and resolves these underlying challenges and implements its plans, DHS will have difficulty achieving significant results in strengthening the cybersecurity of our critical infrastructures.