Federal  policies address the importance of coordination between the government  and the private sector to protect the nation’s computer-reliant critical  infrastructure. DHS concurred with the recommendations. Private Sector Stakeholders Ex Information on Threats, Alerts, and Other Related Services but Believe Federal Partners A Not Consistently Providing

Private sector stakeholders reported that they expect their federal  partners to provide usable, timely, and actionable cyber threat information  and alerts, access to sensitive or classified information, a secure  mechanism for sharing information, security clearances, and a single  centralized government cybersecurity organization to coordinate federal  efforts. For example, only 27 percent of private sector survey  respondents reported that they were receiving timely and actionable cyber  threat information and alerts to a great or moderate extent. While the ongoing efforts may address the public sector’s ability to meet  the private sector’s expectations, much work remains, and it is unclear if  the efforts will focus on fulfilling the private sector’s most expected  services related to information-sharing. Public Sector Stakeholders Expect Threat Information and Commitment, Which the Private Sector Is Generally Providing

Public sector stakeholders reported that they expect the private sector to  provide a commitment to execute plans and recommendations, timely and  actionable cyber threat information, and appropriate staff and resources. However, government council officials stated that improvements could be  made to the partnership. One issue is that private sector  stakeholders do not want to share their sensitive, proprietary information  with the federal government. In turn, federal partners primarily expect their private sector partners to  provide commitment to execute plans and recommendations, timely and  actionable cyber threat and alert information, and appropriate staff and  resources, which the private sector is primarily providing; however, while  most federal partners stated that these expectations are mostly being met,  they identified difficulties with the private sector sharing their sensitive  information and the need for private sector partners to improve their  willingness to engage and provide support to partnership efforts. Federal  and private sector partners have initiated efforts to improve the  partnerships; however, much work remains to fully implement improved  information sharing. Without improvements in meeting private and public  sector expectations, the partnerships will remain less than optimal, and  there is a risk that owners of critical infrastructure will not have the  appropriate information and mechanisms to thwart sophisticated cyber  attacks that could have catastrophic effects on our nation’s cyber-reliant  critical infrastructure. Recommendations for Executive Action

We recommend that the Special Assistant to the President and  Cybersecurity Coordinator and the Secretary of Homeland Security, in  collaboration with the sector lead agencies, coordinating councils, and the  owners and operators of the associated five critical infrastructure sectors,  take two actions: (1) use the results of this report to focus their  information-sharing efforts, including their relevant pilot projects, on the  most desired services, including providing timely and actionable threat  and alert information, access to sensitive or classified information, a  secure mechanism for sharing information, and providing security  clearance and (2) bolster the efforts to build out the National  Cybersecurity and Communications Integration Center as the central focal  point for leveraging and integrating the capabilities of the private sector,  civilian government, law enforcement, the military, and the intelligence  community. Agency Comments and Our Evaluation

The national Cybersecurity Coordinator provided no comments on a draft  of our report. Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine (1) private sector stakeholders’  expectations for cyber-related, public-private partnerships and to what  extent these expectations are being met and (2) public sector  stakeholders’ expectations for cyber-related public-private partnerships  and to what extent expectations are being met.
Why GAO Did This Study

Pervasive and sustained computer-based attacks pose a potentially devastating impact to systems and operations and the critical infrastructures they support. Addressing these threats depends on effective partnerships between the government and private sector owners and operators of critical infrastructure. Federal policy, including the Department of Homeland Security's (DHS) National Infrastructure Protection Plan, calls for a partnership model that includes public and private councils to coordinate policy and information sharing and analysis centers to gather and disseminate information on threats to physical and cyber-related infrastructure. GAO was asked to determine (1) private sector stakeholders' expectations for cyber-related, public-private partnerships and to what extent these expectations are being met and (2) public sector stakeholders' expectations for cyber-related, public-private partnerships and to what extent these expectations are being met. To do this, GAO conducted surveys and interviews of public and private sector officials and analyzed relevant policies and other documents.

What GAO Found

Private sector stakeholders reported that they expect their federal partners to provide usable, timely, and actionable cyber threat information and alerts; access to sensitive or classified information; a secure mechanism for sharing information; security clearances; and a single centralized government cybersecurity organization to coordinate government efforts. However, according to private sector stakeholders, federal partners are not consistently meeting these expectations. For example, less than one-third of private sector respondents reported that they were receiving actionable cyber threat information and alerts to a great or moderate extent. Federal partners are taking steps that may address the key expectations of the private sector, including developing new information-sharing arrangements. However, while the ongoing efforts may address the public sector's ability to meet the private sector's expectations, much work remains to fully implement improved information sharing. Public sector stakeholders reported that they expect the private sector to provide a commitment to execute plans and recommendations, timely and actionable cyber threat information and alerts, and appropriate staff and resources. Four of the five public sector councils that GAO held structured interviews with reported that their respective private sector partners are committed to executing plans and recommendations and providing timely and actionable information. However, public sector council officials stated that improvements could be made to the partnership, including improving private sector sharing of sensitive information. Some private sector stakeholders do not want to share their proprietary information with the federal government for fear of public disclosure and potential loss of market share, among other reasons. Without improvements in meeting private and public sector expectations, the partnerships will remain less than optimal, and there is a risk that owners of critical infrastructure will not have the information necessary to thwart cyber attacks that could have catastrophic effects on our nation's cyber-reliant critical infrastructure.

What GAO Recommends

GAO recommends that the national Cybersecurity Coordinator and DHS work with their federal and private sector partners to enhance information-sharing efforts. The national Cybersecurity Coordinator provided no comments on a draft of this report. DHS concurred with GAO's recommendations.