However, 14  agencies had not defined the CISO’s role for all required activities,  potentially limiting these officials’ ability to effectively oversee these  agencies’ information security programs. Incident response: FISMA requires that agency security programs  include procedures for detecting, reporting, and responding to security  incidents and that agencies report incidents to the United States  Computer Emergency Readiness Team. However, four agencies—the Departments of Energy, the Interior, and the  Treasury; and the Environmental Protection Agency—did not define the  CISO’s role in ensuring that systems were authorized in their policies:
Although DOE delegated the authority to carry out the responsibilities  of the CIO under FISMA, including developing and maintaining the  DOE-wide information security program, to the DOE CISO, the  department’s cybersecurity program order did not describe any  specific roles or responsibilities for the CISO in ensuring that  information systems are authorized to operate. Federal CISOs Identified Challenges to Their Authority That Limit Their Ability to Effectively Manage Agency-Wide Information Security Programs

Agency CISOs identified a number of challenges to their authority. CISOs Reported That Other Factors Presented Challenges

The 24 CISOs also reported that other factors posed challenges to their  ability to carry out their responsibilities effectively, including the following  examples:
Lack of sufficient staff. CISOs identified challenges with having  insufficient personnel to oversee security activities effectively. Recruiting, hiring, and retaining security personnel. Expertise of security personnel. Federal Efforts Are Under Way to Address Selected Challenges, but OMB Has Not Issued Guidance Addressing Challenges to CISOs’ Authority

In accordance with their statutory responsibilities under FISMA, OMB and  NIST have taken steps to assist federal agencies in implementing  information security activities, and have instituted initiatives that can  assist federal agencies in addressing challenges related to human and  financial resources. In July 2016, OMB issued its update to Circular A-130, Managing  Information as a Strategic Resource. Additional guidance from OMB addressing how agencies should  ensure that officials carry out their responsibilities and personnel are held  accountable for complying with the agency-wide information security  program could assist CISOs in more effectively carrying out their duties in  the face of numerous challenges. We are also making 33 recommendations to 13 of the 24 departments  and agencies in our review to ensure that the role of the CISO is defined  in agency policy in accordance with FISMA. One agency, DOD, did not concur  or partially concurred with the three recommendations we made to it. We disagree that existing guidance and oversight mechanisms provide  sufficient clarity for agencies on how to implement the new FISMA 2014  provisions. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) identify the key responsibilities of federal chief  information security officers (CISO) established by federal law and  guidance and determine the extent to which federal agencies have  defined the role of the CISO in accordance with this law and guidance  and (2) describe key challenges of federal agency CISOs in fulfilling their  responsibilities to ensure that agency-wide information security programs  are developed, documented, and implemented. Appendix II: Recommendations to Departments and Agencies

	Department of Commerce

To ensure that the role of the chief information security officer (CISO) is  defined in department policy in accordance with the Federal Information  Security Modernization Act of 2014 (FISMA 2014), we recommend that  the Secretary of Commerce take the following action:
Define the CISO’s role in department policy for ensuring that plans  and procedures are in place to ensure recovery and continued  operations of the department’s information systems in the event of a  disruption. DOD did not concur with four of these  draft recommendations and partially concurred with one of them. We  therefore continue to believe that our recommendation is warranted.
Why GAO Did This Study

Federal agencies face an ever-increasing array of cyber threats to their information systems and information. To address these threats, FISMA 2014 requires agencies to designate a CISO—a key position in agency efforts to manage information security risks.
GAO was asked to review current CISO authorities. This report identifies (1) the key responsibilities of federal CISOs established by federal law and guidance and the extent to which federal agencies have defined the role of the CISO in accordance with law and guidance and (2) key challenges of federal CISOs in fulfilling their responsibilities. GAO reviewed agency security policies, administered a survey to 24 CISOs, interviewed current CISOs, and spoke with officials from OMB.

What GAO Found

Under the Federal Information Security Modernization Act of 2014 (FISMA 2014), the agency chief information security officer (CISO) has the responsibility to ensure that the agency is meeting the requirements of the law, including developing, documenting, and implementing the agency-wide information security program. However, 13 of the 24 agencies GAO reviewed had not fully defined the role of their CISO in accordance with these requirements. For example, these agencies did not always identify a role for the CISO in ensuring that security controls are periodically tested; procedures are in place for detecting, reporting, and responding to security incidents; or contingency plans and procedures for agency information systems are in place. Thus, CISOs' ability to effectively oversee these agencies' information security activities can be limited.
The 24 CISOs GAO surveyed identified challenges that limited their authority to carry out their responsibilities to oversee information security activities. These challenges can impact agencies' ability to effectively manage information security risk. The table below shows the factors that CISOs reported as being the most challenging to their authority.
The 24 CISOs also reported that other factors posed challenges to their abilities to carry out their responsibilities effectively, including difficulties related to having sufficient staff; recruiting, hiring, and retaining security personnel; ensuring that security personnel have appropriate expertise and skills; and a lack of sufficient financial resources. Several government-wide activities are under way to address many of these challenges. However, while the Office of Management and Budget (OMB) has a statutory responsibility under FISMA 2014 to provide guidance on information security in federal agencies, it has not issued such guidance addressing how agencies should ensure that officials carry out their responsibilities and personnel are held accountable for complying with the agency-wide information security program. As a result, agencies lack clarity on how to ensure that their CISOs have adequate authority to effectively carry out their duties in the face of numerous challenges.

What GAO Recommends

GAO is making 33 recommendations to 13 agencies to fully define the role of their CISOs in accordance with FISMA 2014. Twelve of the 13 agencies concurred with the recommendations addressed to them. One agency partially concurred or did not concur with the recommendations directed to it. GAO continues to believe that these recommendations are valid and should be implemented as discussed in this report. GAO also recommends that OMB issue guidance for clarifying CISOs' roles in light of identified challenges. OMB partially concurred with the recommendation. GAO maintains that action is needed as discussed further in the report.