Cyber incidents reported by federal agencies increased  in fiscal year 2013 significantly over the prior 3 years (see fig. Federal Law and Policy Establish a Framework for Managing Cyber Risks

FISMA sets up a layered framework for managing cyber risks and assigns  specific responsibilities to (1) OMB, including to develop and oversee the  implementation of policies, principles, standards, and guidelines for  information security; to report, at least annually, on agency compliance  with the act; and to approve or disapprove agency information security  programs; (2) agency heads, including to provide information security  protections commensurate with the risk and magnitude of the harm  resulting from unauthorized access, use, disclosure, disruption,  modification, or destruction of information collected or maintained by or  on behalf of the agency; (3) agency heads and chief information officers,  including to develop, document, and implement an agencywide  information security program; (4) inspectors general, to conduct annual  independent evaluations of agency efforts to effectively implement  information security; and (5) NIST, to provide standards and guidance to  agencies on information security. Agencies Did Not Consistently Demonstrate Effective Cyber Incident Response Practices

Based on our statistical sample of cyber incidents reported in fiscal year  2012, we estimate that the 24 agencies did not effectively or consistently  demonstrate actions taken in response to a detected incident in about 65  percent of reported incidents. Further,  although the 6 selected agencies we reviewed had developed policies,  plans, and procedures to guide their incident response activities, such  efforts were not comprehensive or consistent with federal requirements. Our sample indicates that agencies demonstrated that they had contained  the majority of their cyber incidents. However, selected agencies’ policies, plans, and procedures  did not always include key information. In addition, the current CyberStat reviews have not generally covered  agencies’ cyber incident response practices, such as considering impact  to aid in prioritizing incident response activities, recording key steps in  responding to an incident, and documenting the costs for responding to  an incident. Without  addressing response practices in these reviews, OMB and DHS may be  missing opportunities to help agencies improve their information security  posture and more effectively respond to cyber incidents. DHS  components, including US-CERT, offer services that assist agencies in  preparing to handle incidents, maintain awareness of the current threat  environment, and deal with ongoing incidents. Based on responses to our  survey, officials at 24 major agencies were generally satisfied with DHS’s  service offerings, although they identified improvements they believe  would make certain services more useful, such as improving reporting  requirements. US-CERT Receives Feedback to Improve Services, but Has Not Yet Developed Performance Measures for Evaluating the Effectiveness of Assistance Provided to Agencies

We and othersmeasures that demonstrate results. However, without results-oriented  performance measures, US-CERT will face challenges in ensuring it is  effectively assisting federal agencies with preparing for and responding to  cyber incidents. However, agencies did not consistently demonstrate  that they responded to cyber incidents in an effective manner. Recommendations for Executive Action

To improve the effectiveness of governmentwide cyber incident response  activities, we recommend that the Director of OMB and Secretary of  Homeland Security address agency incident response practices  governmentwide, in particular through CyberStat meetings, such as  emphasizing the recording of key steps in responding to an incident. Appendix I: Objectives, Scope, and Methodology

Our objectives were to evaluate the extent to which (1) federal agencies  are effectively responding to cyber incidents and (2) the Department of  Homeland Security (DHS) provides cyber incident assistance to agencies. First, we selected 6 agencies from the  population of 24 major agencies covered by the Chief Financial Officers  Act, using probability proportionate to the number of cyber incidents  those agencies had reported to US-CERT in fiscal year 2012, divided by  32,442—the total number of cyber incidents reported to US-CERT in  fiscal year 2012—sampling without replacement. This  statistical sample allowed us to project the results, with 95 percent  confidence, to the 24 major agencies. To address the effectiveness with which agencies responded to a cyber  incident, we reviewed documents (extracted from agencies’ incident  tracking systems) covering the incidents in our sample to determine the  extent to which the agencies had performed analysis, containment,  eradication, recovery, reporting, and post-incident procedures in  accordance with federal requirements and guidance and their own  policies and procedures. In addition, we interviewed  agency officials from the six agencies selected as part of our random  sample regarding their interactions with DHS in receiving cyber incident  assistance.
Why GAO Did This Study

The number of cyber incidents reported by federal agencies increased in fiscal year 2013 significantly over the prior 3 years (see figure). An effective response to a cyber incident is essential to minimize any damage that might be caused. DHS and US-CERT have a role in helping agencies detect, report, and respond to cyber incidents.
GAO was asked to review federal agencies' ability to respond to cyber incidents. To do this, GAO reviewed the extent to which (1) federal agencies are effectively responding to cyber incidents and (2) DHS is providing cybersecurity incident assistance to agencies. To do this, GAO used a statistical sample of cyber incidents reported in fiscal year 2012 to project whether 24 major federal agencies demonstrated effective response activities. In addition, GAO evaluated incident response policies, plans, and procedures at 6 randomly-selected federal agencies to determine adherence to federal guidance. GAO also examined DHS and US-CERT policies, procedures, and practices, and surveyed officials from the 24 federal agencies on their experience receiving incident assistance from DHS.

What GAO Found

Twenty-four major federal agencies did not consistently demonstrate that they are effectively responding to cyber incidents (a security breach of a computerized system and information). Based on a statistical sample of cyber incidents reported in fiscal year 2012, GAO projects that these agencies did not completely document actions taken in response to detected incidents in about 65 percent of cases (with 95 percent confidence that the estimate falls between 58 and 72 percent). For example, agencies identified the scope of an incident in the majority of cases, but frequently did not demonstrate that they had determined the impact of an incident. In addition, agencies did not consistently demonstrate how they had handled other key activities, such as whether preventive actions to prevent the reoccurrence of an incident were taken. Although all 6 selected agencies that GAO reviewed in depth had developed parts of policies, plans, and procedures to guide their incident response activities, their efforts were not comprehensive or fully consistent with federal requirements. In addition, the Office of Management and Budget (OMB) and the Department of Homeland Security (DHS) conduct CyberStat reviews, which are intended to help federal agencies improve their information security posture, but the reviews have not addressed agencies' cyber incident response practices. Without complete policies, plans, and procedures, along with appropriate oversight of response activities, agencies face reduced assurance that they can effectively respond to cyber incidents.
DHS and a component, the United States Computer Emergency Readiness Team (US-CERT), offer services that assist agencies in preparing to handle cyber incidents, maintain awareness of the current threat environment, and deal with ongoing incidents. Officials from the 24 agencies GAO surveyed said that they were generally satisfied with the assistance provided, and made suggestions to make the services more useful, such as improving reporting requirements. Although US-CERT receives feedback from agencies to improve its services, it has not yet developed performance measures for evaluating the effectiveness of the assistance it provides to agencies. Without results-oriented performance measures, US-CERT will face challenges in ensuring it is effectively assisting federal agencies with preparing for and responding to cyber incidents.

What GAO Recommends

GAO is making recommendations to OMB and DHS to address incident response practices governmentwide, particularly in CyberStat meetings with agencies; to the heads of six agencies to strengthen their incident response policies, plans, and procedures; and to DHS to establish measures of effectiveness for the assistance US-CERT provides to agencies. The agencies generally concurred with GAO's recommendations.