DOD Office of Small Business Programs Had Not Identified and Disseminated Cybersecurity Resources to Defense Small Businesses

DOD OSBP officials have explored some ways whereby the office could  integrate cybersecurity into its existing outreach and education efforts;  however, as of July 2015, the office had not identified and disseminated  information about cybersecurity resources in its outreach and education  efforts to defense small businesses. While DOD OSBP is not required to  educate small businesses on cybersecurity, DOD OSBP officials  acknowledged that cybersecurity is an important and timely issue for  small businesses—and therefore the office is considering incorporating  cybersecurity into its existing outreach and education efforts. We identified 15 existing federal cybersecurity outreach and education  resources that the office could leverage for defense small businesses. This  resource is available to defense small businesses. While DOD OSBP officials recognized the importance of identifying and  disseminating cybersecurity resources through outreach and education  efforts to defense small businesses, they also identified a number of  factors that had, to date, limited their progress in doing so. While we recognize that these  factors could affect progress, federal government internal controls state  that management should ensure that there are adequate means of  communicating with, and obtaining information from, external  stakeholders who may have a significant impact on the agency’s  achieving its goals. While they had not yet identified or disseminated  information about existing cybersecurity resources to defense small  businesses, officials agreed that doing so could help the businesses to  become more aware of cybersecurity practices and cyber threats. In  addition, by identifying and disseminating this information, DOD OSBP  could help defense small businesses to protect their networks against  cyber exploits, which would support the 2015 DOD Cyber Strategy goals  of working with the private sector to help secure defense industrial base  trade data and build layered cyber defenses. While DOD OSBP officials  have recognized the importance of educating defense small businesses  about cybersecurity, they have not identified and disseminated  cybersecurity resources through their outreach and education efforts to  businesses because they have been focused on other priorities, such as  developing a training curriculum for DOD professionals who work with  small businesses. Appendix I: Scope and Methodology

We focused our review on the Department of Defense (DOD) Office of  Small Business Programs (OSBP) because this office is responsible for  providing small business policy advice to the Office of the Secretary of  Defense and for providing policy oversight to DOD military department  and DOD component small business offices, per DOD Directive 4205.01. To address the extent to which the DOD OSBP has integrated  cybersecurity into its existing outreach and education efforts for defense  small businesses, we analyzed documentation and interviewed officials  from the DOD OSBP about its existing cybersecurity outreach and  education efforts to small businesses. GAO-15-758T.
Why GAO Did This Study

Small businesses, including those that conduct business with DOD, are vulnerable to cyber threats and may have fewer resources, such as robust cybersecurity systems, than larger businesses to counter cyber threats.
The Joint Explanatory Statement accompanying the National Defense Authorization Act for Fiscal Year 2015 included a provision that GAO assess DOD OSBP's outreach and education efforts to small businesses on cyber threats. This report addresses the extent to which DOD OSBP has integrated cybersecurity into its outreach and education efforts to defense small businesses. DOD OSBP's mission includes providing small business policy advice to the Office of the Secretary of Defense, and policy oversight to DOD military department and component small business offices.
To conduct this review, GAO analyzed documentation and interviewed officials from DOD OSBP about its cybersecurity outreach and education efforts. GAO also analyzed documentation and interviewed officials from nine organizations selected for their cybersecurity expertise to identify examples of cybersecurity outreach and education programs potentially available to defense small businesses.

What GAO Found

The Department of Defense (DOD) Office of Small Business Programs (OSBP) has explored some options, such as online training videos, to integrate cybersecurity into its existing efforts; however, as of July 2015, the office had not identified and disseminated cybersecurity resources in its outreach and education efforts to defense small businesses. While DOD OSBP is not required to educate small businesses on cybersecurity, DOD OSBP officials acknowledged that cybersecurity is an important and timely issue for small businesses—and therefore the office is considering incorporating cybersecurity into its existing outreach and education efforts. During the review, GAO identified 15 existing federal cybersecurity resources that DOD OSBP could disseminate to defense small businesses.
Source: GAO analysis of information from listed agencies. | GAO-15-777
While DOD OSBP officials recognized the importance of identifying and disseminating cybersecurity resources through outreach and education efforts to small businesses, they identified factors that had limited their progress in doing so. Specifically, they were not aware of existing cybersecurity resources, they had leadership turnover in the office, and the office was focused on developing a training curriculum for professionals who work with small businesses. While GAO recognizes that these factors could affect progress, federal government internal controls state that management should ensure there are adequate means of communicating with, and obtaining information from, external stakeholders who may have a significant impact on the agency's achieving its goals. DOD OSBP officials agreed that identifying and disseminating information about existing cybersecurity resources to defense small businesses could help small businesses be more aware of cybersecurity practices and cyber threats. In addition, by identifying and disseminating this information, DOD OSBP could help small businesses to protect their networks, thereby supporting the 2015 DOD Cyber Strategy goals of working with the private sector to help secure defense industrial base trade data and build layered cyber defenses.

What GAO Recommends

GAO recommends that DOD identify and disseminate cybersecurity resources to defense small businesses. DOD concurred with the recommendation and agreed to implement training events and education programs.