	Background

The United States has approximately 360 commercial sea and river ports  that handle more than $1.3 trillion in cargo annually. Federal Stakeholders Have Taken Limited Actions to Address Cybersecurity in the Maritime Port Environment

DHS and the other stakeholders have taken limited steps with respect to  maritime cybersecurity. The Coast Guard Did Not Address Cyber-Related Risks in a National-Level Risk Assessment for the Maritime Mode

While the Coast Guard has assessed risks associated with physical  threats to port environments, these assessments have not considered  risks related to cyber threats. Until the Coast  Guard completes a thorough assessment of cyber risks in the maritime  environment, maritime stakeholders will be less able to appropriately plan  and allocate resources to protect the maritime transportation mode. However, the MTSA-required plans did not identify or address any other  potential cyber-related threats directed at or vulnerabilities in the  information and communications systems or include cybersecurity  measures that port area stakeholders should take to prevent, manage,  and respond to cyber-related threats and vulnerabilities. This  occurred in part because, as Coast Guard officials stated, the guidance  for developing area maritime security plans did not require the inclusion of  a cyber component. Information-Sharing Mechanisms Were Active and Shared Cybersecurity Information to Varying Degrees

Although the Coast Guard helped to establish mechanisms for sharing  security-related information, the degree to which these mechanisms were  active and shared cybersecurity-related information varied. However, the council  disbanded in March 2011 and is no longer active. As a result, the Coast Guard would  not be aware of and thus not be able to mitigate cyber-based threats. Port Security Grant Program Provides Some Guidance for Cybersecurity Grants but Has Not Taken Additional Steps to Help Ensure Risks are Addressed

Under the Port Security Grant Program, FEMA has taken steps to  address cybersecurity in port areas by identifying enhancing  cybersecurity capabilities as a funding priority in fiscal years 2013 and  2014 and by providing general guidance regarding the types of  cybersecurity-related proposals eligible for funding. In addition, because the Coast Guard has not conducted a  comprehensive risk assessment for the maritime environment that  includes cyber-related threats, grant applicants and DHS officials have  not been able to use the results of such an assessment to inform their  grant proposals, project scoring, and risk-based funding decisions. However, until it develops procedures to instruct  grant reviewers to consult cybersecurity-related subject matter experts  and uses the results of a risk assessment that identifies any cyber-related  threats and vulnerabilities to inform its funding guidance, FEMA will be  limited in its ability to ensure that the program is effectively addressing  cyber-related risks in the maritime environment. Recommendations for Executive Action

To enhance the cybersecurity of critical infrastructure in the maritime  sector, we recommend that the Secretary of Homeland Security direct the  Commandant of the Coast Guard to take the following actions: work with federal and nonfederal partners to ensure that the maritime  risk assessment includes cyber-related threats, vulnerabilities, and  potential consequences; use the results of the risk assessment to inform how guidance for area  maritime security plans, facility security plans, and other security- related planning should address cyber-related risk for the maritime  sector; and work with federal and nonfederal stakeholders to determine if the  Maritime Modal Sector Coordinating Council should be reestablished  to better facilitate stakeholder coordination and information sharing  across the maritime environment at the national level. To help ensure the effective use of Port Security Grant Program funds to  support the program’s stated mission of addressing vulnerabilities in the  maritime port environment, we recommend that the Secretary of  Homeland Security direct the FEMA Administrator to take the following  actions:  in coordination with the Coast Guard, develop procedures for officials  at the field review level (i.e., captains of the port) and national review  level (i.e., the National Review Panel and FEMA) to consult  cybersecurity subject matter experts from the Coast Guard and other  relevant DHS components, if applicable, during the review of  cybersecurity grant proposals for funding and  in coordination with the Coast Guard, use any information on cyber- related threats, vulnerabilities, and consequences identified in the  maritime risk assessment to inform future versions of funding  guidance for grant applicants and reviews at the field and national  levels. In its comments, DHS concurred with our  recommendations. Officials from DHS and the Department of Commerce also provided  technical comments via e-mail. Based on our analysis, we determined that the U.S.  Coast Guard (Coast Guard) and Federal Emergency Management  Agency (FEMA), within DHS, were relevant to our objective. It is developing this voluntary framework in accordance with  its mission to promote U.S. innovation and industrial competitiveness. According to Volpe officials, this study was  conducted mostly at international port facilities and vessels (though U.S.  ports were visited under a different program). High Risk Series: An Update.
Why GAO Did This Study

U.S. maritime ports handle more than $1.3 trillion in cargo annually. The operations of these ports are supported by information and communication systems, which are susceptible to cyber-related threats. Failures in these systems could degrade or interrupt operations at ports, including the flow of commerce. Federal agencies—in particular DHS—and industry stakeholders have specific roles in protecting maritime facilities and ports from physical and cyber threats.
GAO's objective was to identify the extent to which DHS and other stakeholders have taken steps to address cybersecurity in the maritime port environment. GAO examined relevant laws and regulations; analyzed federal cybersecurity-related policies and plans; observed operations at three U.S. ports selected based on being a high-risk port and a leader in calls by vessel type, e.g. container; and interviewed federal and nonfederal officials.

What GAO Found

Actions taken by the Department of Homeland Security (DHS) and two of its component agencies, the U.S. Coast Guard and Federal Emergency Management Agency (FEMA), as well as other federal agencies, to address cybersecurity in the maritime port environment have been limited.
While the Coast Guard initiated a number of activities and coordinating strategies to improve physical security in specific ports, it has not conducted a risk assessment that fully addresses cyber-related threats, vulnerabilities, and consequences. Coast Guard officials stated that they intend to conduct such an assessment in the future, but did not provide details to show how it would address cybersecurity. Until the Coast Guard completes a thorough assessment of cyber risks in the maritime environment, the ability of stakeholders to appropriately plan and allocate resources to protect ports and other maritime facilities will be limited.
Maritime security plans required by law and regulation generally did not identify or address potential cyber-related threats or vulnerabilities. This was because the guidance issued by Coast Guard for developing these plans did not require cyber elements to be addressed. Officials stated that guidance for the next set of updated plans, due for update in 2014, will include cybersecurity requirements. However, in the absence of a comprehensive risk assessment, the revised guidance may not adequately address cyber-related risks to the maritime environment.
The degree to which information-sharing mechanisms (e.g., councils) were active and shared cybersecurity-related information varied. Specifically, the Coast Guard established a government coordinating council to share information among government entities, but it is unclear to what extent this body has shared information related to cybersecurity. In addition, a sector coordinating council for sharing information among nonfederal stakeholders is no longer active, and the Coast Guard has not convinced stakeholders to reestablish it. Until the Coast Guard improves these mechanisms, maritime stakeholders in different locations are at greater risk of not being aware of, and thus not mitigating, cyber-based threats.
Under a program to provide security-related grants to ports, FEMA identified enhancing cybersecurity capabilities as a funding priority for the first time in fiscal year 2013 and has provided guidance for cybersecurity-related proposals. However, the agency has not consulted cybersecurity-related subject matter experts to inform the multi-level review of cyber-related proposals—partly because FEMA has downsized the expert panel that reviews grants. Also, because the Coast Guard has not assessed cyber-related risks in the maritime risk assessment, grant applicants and FEMA have not been able to use this information to inform funding proposals and decisions. As a result, FEMA is limited in its ability to ensure that the program is effectively addressing cyber-related risks in the maritime environment.

What GAO Recommends

GAO recommends that DHS direct the Coast Guard to (1) assess cyber-related risks, (2) use this assessment to inform maritime security guidance, and (3) determine whether the sector coordinating council should be reestablished. DHS should also direct FEMA to (1) develop procedures to consult DHS cybersecurity experts for assistance in reviewing grant proposals and (2) use the results of the cyber-risk assessment to inform its grant guidance. DHS concurred with GAO's recommendations.