Two of these  initiatives are related to improving cybersecurity R&D—one is aimed at  improving the coordination of federal cybersecurity R&D, and the other is  aimed at developing a plan for advancing the United States’ R&D in high- risk, high-return areas. One of the report’s  recommendations was to strengthen coordination and oversight of federal  cybersecurity efforts. We identified,  through input from experts from relevant federal, private, and academic  organizations, six major challenges that are impeding efforts to improve  cybersecurity R&D. Specifically, according to the  National Strategy to Secure Cyberspace, a national R&D agenda should  include near-term (1 to 3 years), mid-term (3 to 5 years), and long-term (5  years and longer) goals. It is also essential that cyberspace security research  efforts are ranked across all sectors and funding sources to ensure that  national goals are addressed. While officials from NITRD and OMB stated that they consider the  following key documents to comprise a national R&D agenda, these  documents do not constitute, whether taken collectively or separately, a  prioritized national agenda:    NITRD’s 2006 Cyber Security and Information Assurance Working Group’s  Federal Plan for Cyber Security and Information Assurance R&D: As we  have previously reported, this plan was intended to be the first step  toward developing a federal agenda for cybersecurity research, which  provides baseline information about ongoing federal R&D activities;  however, mid-term and long-term cybersecurity research goals were not  defined. Until  such an agenda is developed that (1) contains short-term, mid-term, and  long-term priorities, (2) includes input from both public and private  sectors, and (3) is consistent with the updated national cybersecurity  strategy (when it is available), increased risk exists that agencies and  private sector organizations will focus on their individual priorities for  cybersecurity R&D, which may not be the most important national  research priorities. Specifically, PITAC indicated that  federal cybersecurity R&D efforts should be focused, coordinated, and  overseen by a central body. Although NITRD is primarily responsible for providing leadership in  coordinating cybersecurity R&D, it has played a facilitator role, rather  than leading agencies in a strategic direction toward a cybersecurity R&D  agenda. Until NITRD exercises its leadership responsibilities, federal agencies will  likely lack overall direction for cybersecurity R&D. Additionally, government and private  sector officials indicated that the government does not have a process in  place to communicate the results on completed federal R&D. Nevertheless, without an ongoing process for industry and government to  share cybersecurity R&D information, the nation could be at great risk of  funding duplicative efforts or having gaps in needed R&D. OMB did not implement our  recommendation. In  addition, a private sector expert stated that having a centralized database  in place would improve coordination between the public and private  sectors. However, without a mechanism to track all active and completed  cybersecurity R&D initiatives, federal researchers and developers as well  as private companies lack essential information about ongoing and  completed R&D, thus increasing the likelihood of duplicative efforts,  inefficient use of government funding, and lost collaboration  opportunities. Finally, the lack  of a mechanism to track all active and completed cybersecurity R&D  initiatives and the lack of a process for sharing information among the  public and private sectors may result in duplicative efforts or gaps in  needed R&D. Recommendation for Executive Action

To help address the key cybersecurity R&D challenges, we are  recommending that the Director of the Office of Science and Technology  Policy, in conjunction with the national Cybersecurity Coordinator, direct  the Subcommittee on Networking and Information Technology Research  and Development to exercise its leadership responsibilities and take the  following four actions:    Establish a comprehensive national R&D agenda by expanding on the  CSIA IWG framework and ensure that it   contains priorities for short-term, mid-term, and long-term complex  cybersecurity R&D; includes input from the private sector and academia; and is consistent with the updated national cybersecurity strategy (when  available). The Assistant Director for Information Technology R&D from OSTP  agreed with our recommendation and provided details on the office’s  plans and actions to address our recommendation. Appendix I: Objective, Scope, and Methodology

The objective of our review was to determine the key challenges to  enhancing national-level cybersecurity research and development (R&D)  efforts among the federal government and private companies. To identify key challenges to enhancing national-level cybersecurity R&D  efforts, we analyzed documentation, such as agencies’ research plans and  cybersecurity reports, and interviewed federal officials and industry  experts.
Why GAO Did This Study

Computer networks and infrastructures, on which the United States and much of the world rely to communicate and conduct business, contain vulnerabilities that can leave them susceptible to unauthorized access, disruption, or attack. Investing in research and development (R&D) is essential to protect critical systems and to enhance the cybersecurity of both the government and the private sector. Federal law has called for improvements in cybersecurity R&D, and, recently, President Obama has stated that advancing R&D is one of his administration's top priorities for improving cybersecurity. GAO was asked to determine the key challenges in enhancing national-level cybersecurity R&D efforts among the federal government and private companies. To do this, GAO consulted with officials from relevant federal agencies and experts from private sector companies and academic institutions as well as analyzed key documents, such as agencies' research plans.

What GAO Found

Several major challenges impede efforts to improve cybersecurity R&D. Among the most critical challenges are the following: 1) Establishing a prioritized national R&D agenda. While R&D that is in support of specific agencies' missions is important, it is also essential that national research efforts be strategically guided by an ordered set of national-level R&D goals. Additionally, it is critical that cyberspace security research efforts are prioritized across all sectors to ensure that national goals are addressed. Accordingly, the National Strategy to Secure Cyberspace recommended that the Office of Science and Technology Policy (OSTP) coordinate the development of an annual cybersecurity research agenda that includes near-term (1-3 years), mid-term (3-5 years), and long-term (5 years or longer) goals. Although OSTP has taken initial steps toward developing such an agenda, one does not currently exist. OSTP and Office of Management and Budget officials stated that they believe an agenda is contained in existing documents; however, these documents are either outdated or lack appropriate detail. Without a current national cybersecurity R&D agenda, the nation is at risk that agencies and private sector companies may focus on their individual priorities, which may not be the most important national research priorities. 2) Strengthening leadership. While officials within OSTP's Subcommittee on Networking and Information Technology Research and Development (NITRD)--a multiagency coordination body that is primarily responsible for providing leadership in coordinating cybersecurity R&D--have played a facilitator role in coordinating cybersecurity R&D efforts within the federal government, they have not led agencies in a strategic direction. NITRD's lack of leadership has been noted by many experts as well as by a presidential advisory committee that reported that federal cybersecurity R&D efforts should be focused, coordinated, and overseen by a central body. Until NITRD exercises its leadership responsibilities, federal agencies will lack overall direction for cybersecurity R&D. 3) Tracking R&D fundingand establishing processes for the public and private sectors to share key R&D information. Despite a congressional mandate to develop a governmentwide repository that tracks federally funded R&D, including R&D related to cybersecurity, such a repository is not currently in place. Additionally, the government does not have a process to foster the kinds of relationships necessary for coordination between the public and private sectors. While NITRD hosted a major conference last year that brought together public, private, and academic experts, this was a one-time event, and, according to experts, next steps remain unclear. Without a mechanism to track all active and completed cybersecurity R&D initiatives, federal researchers and developers as well as private companies lack essential information about ongoing and completed R&D. Moreover, without a process for industry and government to share cybersecurity R&D information, the nation is at risk of having unforeseen gaps.

What GAO Recommends

GAO is recommending that the Director of OSTP direct NITRD to exercise its leadership responsibilities by taking several actions, including developing a national agenda, and establishing and utilizing a mechanism to keep track of federal cybersecurity R&D funding. OSTP agreed with GAO's recommendation and provided details on planned actions. GAO recommends that TSA establish milestones for a staffing study, verify the accuracy of all reported screening data, develop a contingency plan for screening domestic cargo, and develop plans for meeting the mandate as it applies to inbound cargo. TSA partially concurred with verifying screening data and did not concur with developing a contingency plan because it did not believe such actions were feasible. GAO believes these recommendations remain valid, as discussed in this report. TSA agreed with all other recommendations.