In this  capacity, the department has multiple cybersecurity-related roles and  responsibilities. DHS is also responsible for securing its own computer networks, systems,  and information. NIST Is Responsible for Establishing Federal Standards and Guidance for Information Security

FISMA tasks NIST—a component within the Department of Commerce— with responsibility for developing standards and guidelines, including  minimum requirements, for (1) information systems used or operated by  an agency or by a contractor of an agency or other organization on behalf  of the agency and (2) providing adequate information security for all  agency operations and assets, except for national security systems. FISMA also requires NIST to take other actions that include:    conducting research, as needed, to determine the nature and extent of  information security vulnerabilities and techniques for providing cost- effective information security;    developing and periodically revising performance indicators and measures  for agency information security policies and practices;    evaluating private sector information security policies and practices and  commercially available information technologies, to assess potential  application by agencies to strengthen information security; and    assisting the private sector, in using and applying the results of its  activities required by FISMA. Metrics Established to Evaluate Information Security Programs

FISMA also requires the Office of Management and Budget (OMB) to  develop policies, principles, standards, and guidelines on information  security and to report annually to Congress on agency compliance with the  requirements of the act. DHS Has Yet to Fully Satisfy Its Cybersecurity Responsibilities

We have reported since 2005 that DHS has yet to comprehensively satisfy  its key responsibilities for protecting computer-reliant critical  infrastructures. Our reports included about 90 recommendations that we  summarized into key areas, including those listed in table 1, that are  essential for DHS to address in order to fully implement its  responsibilities. DHS has since developed and implemented certain  capabilities to satisfy aspects of its responsibilities, but the department  still has not fully implemented our recommendations, and thus further  action needs to be taken to address these areas. However, DHS had not  established a strategy to coordinate the various control systems activities  across federal agencies and the private sector, and it did not effectively  share information on control system vulnerabilities with the public and  private sectors. We testified in March 2009 regarding the need to bolster public/private  partnerships associated with cyber CIP. This is the second of the mandatory security  standards and specifies minimum security requirements for information  and information systems supporting the executive agencies of the federal  government and a risk-based process for selecting the security controls  necessary to satisfy the minimum security requirements. Through NIST’s efforts, agencies have access to additional tools and  guidance that can be applied to their information security programs. Opportunities for Improving Information Security Metrics

Despite federal agencies reporting increased compliance in implementing  key information security control activities for fiscal year 2008,  opportunities exist to improve the metrics used in annual reporting. In summary, DHS has not fully satisfied aspects of its key cybersecurity  responsibilities, one of which includes its efforts to protect our nation’s  cyber critical infrastructure and still needs to take further action to  address the key areas identified in our recent reports, including enhancing  partnerships with the private sector. NIST has developed a significant number of standards and guidelines for  information security and continues to assist organizations in implementing  security controls over their systems and information.
Why GAO Did This Study

Federal laws and policy have assigned important roles and responsibilities to the Department of Homeland Security (DHS) and the National Institute of Standards and Technology (NIST) for securing computer networks and systems. DHS is charged with coordinating the protection of computer-reliant critical infrastructure--much of which is owned by the private sector--and securing its own computer systems, while NIST is responsible for developing standards and guidelines for implementing security controls over information and information systems. GAO was asked to describe cybersecurity efforts at DHS and NIST--including partnership activities with the private sector--and the use of cybersecurity performance metrics in the federal government. To do so, GAO relied on its reports on federal information security and federal efforts to fulfill national cybersecurity responsibilities.

What GAO Found

Since 2005, GAO has reported that DHS has yet to comprehensively satisfy its key cybersecurity responsibilities, including those related to establishing effective partnerships with the private sector. Shortcomings exist in key areas that are essential for DHS to address in order to fully implement its cybersecurity responsibilities. DHS has since developed and implemented certain capabilities, but still has not fully satisfied aspects of these responsibilities and needs to take further action to enhance the public/private partnerships needed to adequately protect cyber critical infrastructure. GAO has also previously reported on significant security weaknesses in systems supporting two of the department's programs, one that tracks foreign nationals entering and exiting the United States, and one for matching airline passenger information against terrorist watch-list records. DHS has corrected information security weaknesses for systems supporting the terrorist watch-list, but needs to take additional actions to mitigate vulnerabilities associated with systems tracking foreign nationals. NIST plays a key role in providing important information security standards and guidance. Pursuant to its responsibilities under the Federal Information Security Management Act (FISMA), NIST has developed standards specifying minimum security requirements for federal information and information systems; and provided corresponding guidance that details the controls necessary for securing those systems. It has also been working with both public and private sector entities to enhance information security requirements. The resulting guidance and tools provided by NIST serve as important resources for federal agencies that can be applied to information security programs. As GAO recently testified in May, opportunities exist to improve the metrics used to assess agency information security programs. According to the performance metrics established by the Office of Management and Budget (OMB), agencies reported increased compliance in implementing key information security control activities. However, GAO and agency inspectors general continue to report significant weaknesses in controls. This dichotomy exists in part because the OMB-defined metrics generally do not measure how well controls are implemented. As a result, reported metrics may provide an incomplete picture of an agency's information security program.