The Nation Faces an Evolving Array of Cyber- Based Threats

Threats to systems supporting critical infrastructure and federal  information systems are evolving and growing. Federal Policy and Law Address the Protection of Cyber Critical Infrastructure

Because the private sector owns the majority of the nation’s critical  infrastructure—such as banking and financial institutions, commercial  facilities, and energy production and transmission facilities—it is vital that  the public and private sectors work together to protect these assets and  systems. Respondents to our survey  were generally satisfied with NIST’s efforts and methods to develop the  framework. NIST’s Cybersecurity Framework Meets Requirements

NIST implemented the requirements for development of a cybersecurity  approach as required by Executive Order 13636 and the Cybersecurity  Enhancement Act of 2014. Executive Order 13636 required NIST to develop among other things a  flexible, repeatable, performance-based, and cost-effective approach to  help owners and operators of critical infrastructure identify, assess, and  manage cyber risk. Further, based on our analysis, the framework supported and developed  by NIST is intended to be:
Flexible: The NIST framework can be modified to an organization’s  cybersecurity condition and needs. Federal Entities Are Promoting the Cybersecurity Framework, but DHS Is Not Measuring the Effectiveness of Its Efforts

DHS, SSAs, and NIST have promoted adoption and use of the  cybersecurity framework by critical infrastructure owners and operators  through a variety of methods. Specifically, DHS established a program, in  accordance with Executive Order 13636, to encourage adoption of the  framework and has taken a number of actions, including disseminating  guidance and working with stakeholders to promote it. Executive Order 13636 requires SSAs to  determine whether or not it is necessary for their sector to develop sector- specific framework implementation guidance, and SSAs for 15 of the 16  sectors had made this determination as of October 2015. According to officials, these sectors were finalizing their guidance and  had involved their sector stakeholders to review it. DHS and the General Services Administration (GSA), which are the co- SSAs for the government facilities sector, have yet to determine if sector  implementation guidance should be developed. Conclusions

NIST has generally fulfilled its requirements, established in Executive  Order 13636 and the Cybersecurity Enhancement Act, to develop a  cybersecurity framework for adoption by critical infrastructure sectors. In addition, while most  SSAs have determined the need for sector-specific guidance to  implement the framework, DHS and GSA have yet to meet this  requirement for the government facilities sector, which may hinder  adoption of the framework in this sector. Recommendations for Executive Action

To better facilitate adoption of the NIST Framework for Improving Critical  Infrastructure Cybersecurity, we are making the following  recommendations:  We recommend that the Secretary of Homeland Security direct officials  responsible for the Critical Infrastructure Cyber Community Voluntary  Program to develop metrics for measuring the effectiveness of efforts to  promote and support the framework. We also recommend that the Secretary of Homeland Security and the  Administrator of GSA set a time frame for determining the need for  sector-specific guidance to implement the framework in the government  facilities sector. IV), DHS concurred with our two  recommendations. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to determine the extent to which (1) the  National Institute of Standards and Technology (NIST) facilitated the  development of voluntary standards and procedures to reduce cyber risks  to critical infrastructure, and (2) federal agencies promote the standards  and procedures to reduce cyber risks to critical infrastructure. Specifically, we reviewed documentation and videos of the six workshops  hosted by NIST intended to obtain industry, academia, and government  representative feedback in the development of the framework, in addition  to NIST’s two requests for information to the public for input on  cybersecurity standards and methodologies. For DHS, we  analyzed agency documentation and the website of its Critical  Infrastructure Cyber Community (C) Voluntary Program to identify the  framework promotional guidance and tools provided to the critical  infrastructure sectors.
Why GAO Did This Study

U.S. critical infrastructures, such as financial institutions and communications networks, are systems and assets vital to national security, economic stability, and public health and safety. Systems supporting critical infrastructures face an evolving array of cyber-based threats. To better address cyber-related risks to critical infrastructure, federal law and policy called for NIST to develop a set of voluntary cybersecurity standards and procedures that can be adopted by industry to better protect critical cyber infrastructure.
The Cybersecurity Enhancement Act of 2014 included provisions for GAO to review aspects of the cybersecurity standards and procedures developed by NIST. This report determines the extent to which (1) NIST facilitated the development of voluntary cybersecurity standards and procedures and (2) federal agencies promoted these standards and procedures. GAO examined NIST's efforts to develop standards, surveyed a non-generalizable sample of critical infrastructure stakeholders, reviewed agency documentation, and interviewed relevant officials.

What GAO Found

In accordance with requirements in a 2013 executive order which were enacted into law in 2014, the National Institute of Standards and Technology (NIST) facilitated the development of a set of voluntary standards and procedures for enhancing cybersecurity of critical infrastructure. This process, which involved stakeholders from the public and private sectors, resulted in NIST's Framework for Improving Critical Infrastructure Cybersecurity . The framework is to provide a flexible and risk-based approach for entities within the nation's 16 critical infrastructure sectors to protect their vital assets from cyber-based threats. To develop the framework in a collaborative manner, NIST solicited input from sector stakeholders through a formal request for information and conducted multiple workshops with critical infrastructure owners and operators, industry associations, government agencies, and other stakeholders. Participants GAO surveyed were generally satisfied with the approach NIST took to develop the framework. Further, the framework meets the requirements established in federal law that it be flexible, repeatable, performance-based, and cost-effective. For example, the framework contains multiple implementation “tiers,” which allows it to be adapted to an organization's specific conditions and needs.
Agencies with responsibilities for supporting protection efforts in critical infrastructure sectors (known as sector-specific agencies), and NIST have promoted and supported adoption of the cybersecurity framework in the critical infrastructure sectors. For example, the Department of Homeland Security (DHS) established the Critical Infrastructure Cyber Community Voluntary Program to encourage adoption of the framework and has undertaken multiple efforts as part of this program. These include developing guidance and tools that are intended to help sector entities use the framework. However, DHS has not developed metrics to measure the success of its activities and programs. Accordingly, DHS does not know if its efforts are effectively encouraging adoption of the framework.
Sector-specific agencies have also promoted the framework in their sectors by, for example, presenting to meetings of sector stakeholders and holding other promotional events. In addition, all of the sector-specific agencies except for DHS and the General Services Administration (GSA), as co-SSAs for the government facilities sector, had decided whether or not to develop tailored framework implementation guidance for their sectors, as required by Executive Order 13636. Specifically, DHS and GSA had not yet set a time frame to determine whether sector-specific implementation guidance is needed for the government facilities sector. By not doing so, DHS and GSA may be hindering the adoption of the cybersecurity framework in this sector.

What GAO Recommends

GAO recommends that DHS develop metrics to assess the effectiveness of its framework promotion efforts. In addition, DHS and GSA should set a time frame to determine whether implementation guidance is needed for the government facilities sector. DHS and GSA concurred with the recommendations.