For  example, consistent with law, presidential policies stress the importance  of coordination between the government and industry to protect the  nation’s cyber critical infrastructure. Within DHS, the National Protection and Programs Directorate (NPPD) is  responsible for working with public and industry infrastructure partners  and leads the coordinated national effort to mitigate risk to the nation’s  infrastructure through the development and implementation of the  infrastructure protection program. Observations on Key Factors in DHS Implementation of Its Partnership Approach

Our prior work has found that DHS and its partners have taken a number  of steps intended to improve the security of our critical infrastructure. Specifically, our work has identified three key factors that  can affect the implementation of the partnership approach used by DHS:  (1) recognizing and addressing barriers to sharing information; (2) sharing  the results of DHS assessments with industry and other stakeholders;  and (3) measuring and evaluating the performance of DHS’s partnership  efforts. Identifying barriers to industry sharing information with federal  partners. In a July 2010 report examining, among other things,  government stakeholders’ expectations for cyber-related, public- private partnerships we identified some barriers to industry’s sharing  of cyber threat information with federal partners.of the government entities we contacted reported that industry  partners were mostly meeting their expectations in several areas,  including sharing timely and actionable cyber threat information,  though the extent to which this was happening varied by sector. Among other issues, we found that industry partners did not want to  share their sensitive, proprietary information with the federal  government. We will continue to  monitor DHS’s efforts to implement these recommendations. Sharing Results of DHS Assessments with Industry and Other Stakeholders

Another important factor for DHS’s implementation of its partnership  approach is sharing information on the results of its security assessments  and surveys with industry partners and other stakeholders. DHS  security surveys and vulnerability assessments can provide valuable  insights into the strengths and weaknesses of assets and can help  asset owners and operators that participate in these programs make  decisions about investments to enhance security and resilience. In our  May 2012 report, we found that, among other things, DHS shares the  results of security surveys and vulnerability assessments with asset  owners or operators.security survey and vulnerability assessment results could be  enhanced by the timely delivery of these products to the owners and  operators and that the inability to deliver these products in a timely  manner could undermine the relationship DHS was attempting to  develop with these industry partners. We recommended, and DHS concurred, that it  develop time frames and specific milestones for managing its efforts  to ensure the timely delivery of the results of security surveys and  vulnerability assessments to asset owners and operators. Critical infrastructures rely on networked computers and  systems, thus making them susceptible to cyber-based risks. We also reported that DHS had been working to  conceptualize how it can develop a product or products using multiple  sources—including RRAP reports—to more widely share resilience  lessons learned to its critical infrastructure partners, including federal,  state, local, and tribal officials. Taking  a systematic approach to gathering feedback from industry owners  and operators and measuring the results of these efforts could help  focus greater attention on targeting potential problems and areas  needing improvement. In April 2013, we examined DHS’s Chemical  Facility Anti-Terrorism Standards (CFATS) program and assessed,  among other things, the extent to which DHS has communicated and  worked with owners and operators to improve security. Specifically,  we reported that DHS had increased its efforts to communicate and  work with industry owners and operators to help them enhance  security at their facilities since 2007. However, despite increasing its efforts to communicate with industry  owners and operators, we also found that DHS had an opportunity to  obtain systematic feedback on its outreach. We recommended that  DHS explore opportunities and take action to systematically solicit and  document feedback on facility outreach. DHS  concurred with our recommendation and reported that it had actions  underway to review alternatives, including possibly revising its  security survey and vulnerability assessment follow-up tool, to  address this recommendation. However, more needs to be done to  accelerate the progress made in bolstering the cybersecurity posture of  the nation. The administration and executive branch agencies need to  fully implement the hundreds of recommendations made by GAO and  agency inspectors general to address cyber challenges.
Why GAO Did This Study

Federal efforts to protect the nation's critical infrastructure from cyber threats has been on GAO's list of high-risk areas since 2003. Critical infrastructure is assets and systems, whether physical or cyber, so vital to the United States that their destruction would have a debilitating impact on, among other things, national security and the economy. Recent cyber attacks highlight such threats. DHS, as the lead federal agency, developed a partnership approach with key industries to help protect critical infrastructure.
This testimony identifies key factors important to DHS implementation of the partnership approach to protect critical infrastructure.
This statement is based on products GAO issued from October 2001 to March 2014. To perform this work, GAO reviewed applicable laws, regulations, and directives as well as policies and procedures for selected programs. GAO interviewed DHS officials responsible for administering these programs and assessed related data. GAO also interviewed and surveyed a range of other stakeholders including federal officials, industry owners and operators, industry groups, and cybersecurity experts.

What GAO Found

GAO's prior work has identified several key factors that are important for the Department of Homeland Security (DHS) to implement its partnership approach with industry to protect critical infrastructure. DHS has made some progress in implementing its partnership approach, but has also experienced challenges coordinating with industry partners that own most of the critical infrastructure.
Recognizing and Addressing Barriers to Sharing Information. Since 2003, GAO has identified information sharing as key to developing effective partnerships. In July 2010, GAO reported some barriers affecting the extent to which cyber-related security information was being shared between federal and industry partners. For example, industry partners reported concerns that sharing sensitive, proprietary information with the federal government could compromise their competitive advantage if shared more widely. Similarly, federal partners were restricted in sharing classified information with industry officials without security clearances. GAO recommended that DHS work with industry to focus its information-sharing efforts. DHS concurred and has taken some steps to address the recommendation, including sponsoring clearances for industry.
Sharing Results of DHS Assessments with Industry. GAO has found that DHS security assessments can provide valuable insights into the strengths and weaknesses of critical assets and drive industry decisions about investments to enhance security. In a May 2012 report, GAO found that DHS was sharing the results of its assessments with industry partners, but these results were often late, which could undermine the relationship DHS was attempting to develop with these partners. GAO recommended that DHS develop time frames and milestones to ensure the timely delivery of the assessments to industry partners. DHS concurred and reported that it has efforts underway to speed the delivery of its assessments.
Measuring and Evaluating Performance of DHS Partnerships . GAO's prior work found that taking a systematic approach to gathering feedback from industry owners and operators and measuring the results of these efforts could help focus greater attention on targeting potential problems and areas needing improvement. In an April 2013 report, GAO examined DHS's chemical security program and assessed, among other things, the extent to which DHS has communicated and worked with industry owners and operators to improve security. GAO reported that DHS had increased its efforts to communicate and work with industry to help them enhance security at their facilities. However, GAO found that DHS was not obtaining systematic feedback on its outreach. GAO recommended that DHS explore opportunities and take action to systematically solicit and document feedback on industry outreach. DHS concurred and reported that it had taken action to address the recommendation.
However, the cyber security of infrastructure remains on GAO's high-risk list and more needs to be done to accelerate the progress made. DHS still needs to fully implement the many recommendations on its partnership approach (and other issues) made by GAO and inspectors general to address cyber challenges.

What GAO Recommends

GAO has made recommendations to DHS in prior reports to strengthen its partnership efforts. DHS generally agreed with these recommendations and reports actions or plans to address many of them. GAO will continue to monitor DHS efforts to address these recommendations.