	Federal Law and Policy Establish a Framework for Protecting Federal Systems and Information

Several federal laws and policies—predominantly the Federal Information  Security Modernization Act of 2014 and its predecessor, the Federal  Information Security Management Act of 2002 (both referred to as  FISMA)—provide a framework for protecting federal information and IT  assets. More recently, OMB issued the  Cybersecurity Strategy and Implementation Plan for the Federal  Civilian Government in October 2015, which aims to strengthen  federal civilian cybersecurity by (1) identifying and protecting high- value information and assets, (2) detecting and responding to cyber  incidents in a timely manner, (3) recovering rapidly from incidents  when they occur and accelerating the adoption of lessons learned, (4)  recruiting and retaining a highly qualified cybersecurity workforce, and  (5) efficiently acquiring and deploying existing and emerging  technology. Each agency is also required to develop, document, and implement an  agency-wide information security program that involves an ongoing cycle  of activity including (1) assessing risks, (2) developing and implementing  risk-based policies and procedures for cost-effectively reducing  information security risk to an acceptable level, (3) providing awareness  training to personnel and specialized training to those with significant  security responsibilities, (4) testing and evaluating effectiveness of  security controls, (5) remedying known weaknesses, and (6) detecting,  reporting, and responding to security incidents. As discussed later, our work has shown that agencies have not fully or  effectively implemented these programs and activities on a consistent  basis. While the administration and  agencies have acted to improve the protections over their information and  information systems, additional actions are needed. Since  FISMA was enacted in 2002, agencies have been challenged to fully and  effectively develop, document, and implement agency-wide programs to  secure the information and information systems that support the  operations and assets of the agency, including those provided or  managed by another agency or contractor. Enhance capabilities to effectively identify cyber threats to agency  systems and information. Implement sustainable processes for securely configuring operating  systems, applications, workstations, servers, and network devices. Patch vulnerable systems and replace unsupported software. Even agencies or  organizations with strong security can fall victim to information security  incidents due to previously unknown vulnerabilities that are exploited by  attackers to intrude into an agency’s information systems. DHS needs to expand capabilities, improve planning, and support  wider adoption of its government-wide intrusion detection and  prevention system. In addition, adoption of these capabilities at federal  agencies was limited. Improve cyber incident response practices at federal agencies. Update federal guidance on reporting data breaches and develop  consistent responses to breaches of personally identifiable  information (PII). The federal government needs to expand its cyber workforce  planning and training efforts. Ensuring that the government has a  sufficient number of cybersecurity professionals with the right skills and  that its overall workforce is aware of information security responsibilities  remains an ongoing challenge. This has been a long-standing dilemma for the federal  government. However, implementation of this  framework has been inconsistent, and additional action is needed to  address ongoing challenges. Specifically, agencies need to address  control deficiencies and fully implement organization-wide information  security programs, cyber incident response and mitigation efforts need to  be improved across the government, and establishing and maintaining a  qualified cybersecurity workforce needs to be a priority.
Why GAO Did This Study

The dependence of federal agencies on computerized information systems and electronic data makes them potentially vulnerable to a wide and evolving array of cyber-based threats. Securing these systems and data is vital to the nation's safety, prosperity, and well-being.
Because of the significance of these risks and long-standing challenges in effectively implementing information security protections, GAO has designated federal information security as a government-wide high-risk area since 1997. In 2003 this area was expanded to include computerized systems supporting the nation's critical infrastructure, and again in February 2015 to include protecting the privacy of personally identifiable information collected, maintained, and shared by both federal and nonfederal entities.
GAO was asked to provide a statement on laws and policies shaping the federal IT security landscape and actions needed for addressing long-standing challenges to improving the nation's cybersecurity posture. In preparing this statement, GAO relied on previously published work.
Over the past several years, GAO has made about 2,500 recommendations to federal agencies to enhance their information security programs and controls. As of September 16, 2016, about 1,000 have not been implemented.

What GAO Found

Cyber incidents affecting federal agencies have continued to grow, increasing about 1,300 percent from fiscal year 2006 to fiscal year 2015.
Several laws and policies establish a framework for the federal government's information security and assign implementation and oversight responsibilities to key federal entities, including the Office of Management and Budget, executive branch agencies, and the Department of Homeland Security (DHS).
However, implementation of this framework has been inconsistent, and additional actions are needed:
Effectively implement risk-based information security programs. Agencies have been challenged to fully and effectively establish and implement information security programs. They need to enhance capabilities to identify cyber threats, implement sustainable processes for securely configuring their computer assets, patch vulnerable systems and replace unsupported software, ensure comprehensive testing and evaluation of their security on a regular basis, and strengthen oversight of IT contractors.
Improve capabilities for detecting, responding to, and mitigating cyber incidents. Even with strong security, organizations can continue to be victimized by attacks exploiting previously unknown vulnerabilities. To address this, DHS needs to expand the capabilities and adoption of its intrusion detection and prevention system, and agencies need to improve their practices for responding to cyber incidents and data breaches.
Expand cyber workforce and training efforts. Ensuring that the government has a sufficient cybersecurity workforce with the right skills and training remains an ongoing challenge. Government-wide efforts are needed to better recruit and retain a qualified cybersecurity workforce and to improve workforce planning activities at agencies.