Research in cyber security technology can help create a broader  range of choices and more robust tools for building secure, networked  computer systems. Numerous Federal Entities Involved in Cyber Security Research and Development

Numerous federal agencies and organizations are involved in federally  funded cyber security R&D. The Office of Science and Technology  Policy oversees the National Science and Technology Council, which  prepares R&D strategies that are coordinated across federal agencies. The  council operates through its committees, subcommittees, and interagency  working groups, which coordinate activities related to specific science and  technology disciplines. Other Groups Support Coordination on Informal Basis

Participation by federal entities in other interagency groups provides  opportunities for enhanced coordination of cyber security R&D efforts on  an informal basis. Federal Entities Have Improved Oversight and Coordination, but Limitations Remain

Federal entities have taken several important steps to improve the  oversight and coordination of federal cyber security R&D. These include  (1) chartering an interagency working group to focus on this type of  research, (2) publishing a federal plan for cyber security and information  assurance research that is to provide baseline information and a  framework for planning and conducting this research, (3) separating the  reporting of budget information for cyber security research from other  types of research, and (4) maintaining governmentwide repositories of  information on R&D projects. According to the Interagency Working Group for Cyber Security and  Information Assurance, which operates under the auspices of the Office of  Science of Technology Policy and the National Science and Technology  Council, the Federal Plan for Cyber Security and Information Assurance  Research and Development is the first step towards developing a federal  agenda for cyber security research. The governmentwide repositories were incomplete and not fully  populated, in part, because OMB had not issued guidance to ensure that  agencies had provided all information required for the repositories. The National Science Foundation essentially relies on the researcher or  grantee to disseminate information about National Science Foundation- funded research. The Department of Homeland Security has several methods for technology  transfer, such as attending conferences and workshops and working with  industry in several areas to share information about emerging threats and  R&D needs. However, key  elements of the federal research agenda called for in the National Strategy  to Secure Cyberspace have not been developed, thereby increasing the  risk that mid- and longer-term research priorities may not be achieved. Appendix I: Objectives, Scope, and Methodology

Our objectives were to identify the (1) federal agencies that are involved  with cyber security research and development (R&D); (2) actions taken to  improve oversight and coordination of cyber security research and  development, including the development of a federal research agenda; and  (3) methods used for technology transfer at the agencies with significant  activities in cyber security research and development. To identify actions taken to improve oversight and coordination of federal  cyber security R&D, including the development of a governmentwide  research agenda, we interviewed officials at the National Science  Foundation, the National Institute of Standards and Technology, the  National Security Agency, the Departments of Defense and Homeland  Security, the Subcommittee on NITRD, the Technical Support Working  Group, the Office of Science and Technology Policy, and the Infosec  Research Council.
Why GAO Did This Study

Research and development (R&D) of cyber security technology is essential to creating a broader range of choices and more robust tools for building secure, networked computer systems in the federal government and in the private sector. The National Strategy to Secure Cyberspace identifies national priorities to secure cyberspace, including a federal R&D agenda. GAO was asked to identify the (1) federal entities involved in cyber security R&D; (2) actions taken to improve oversight and coordination of federal cyber security R&D, including developing a federal research agenda; and (3) methods used for technology transfer at agencies with significant activities in this area. To do this, GAO examined relevant laws, policies, budget documents, plans, and reports.

What GAO Found

Several federal entities are involved in federal cyber security research and development. The Office of Science and Technology Policy and OMB establish high-level research priorities. The Office of Science and Technology Policy is to coordinate the development of a federal research agenda for cyber security and oversee the National Science and Technology Council, which prepares R&D strategies that are to be coordinated across federal agencies. The Council operates through its committees, subcommittees, and interagency working groups, which oversee and coordinate activities related to specific science and technology disciplines. The Subcommittee on Networking and Information Technology Research and Development and the Cyber Security and Information Assurance Interagency Working Group are prominently involved in the coordination of cyber security research. In addition, other groups provide mechanisms for coordination of R&D efforts on an informal basis. The National Science Foundation and the Departments of Defense and Homeland Security fund much of this research. Federal entities have taken several important steps to improve the oversight and coordination of federal cyber security R&D, although limitations remain. Actions taken include chartering an interagency working group to focus on cyber security research, publishing a federal plan for guiding this research, reporting budget information for this research separately, and maintaining repositories of information on R&D projects. However, a federal cyber security research agenda has not been developed as recommended in the National Strategy to Secure Cyberspace and the federal plan did not fully address certain key elements. Further, the repositories do not contain information about all of the federally funded cyber security research projects in part because OMB had not issued guidance to ensure that agencies provided all information required for the repositories. As a result, information needed for oversight and coordination of cyber security research activities was not readily available. Federal agencies use a variety of methods for sharing the results of cyber security research with federal and private organizations (technology transfer), including sharing information through agency Web sites. Other methods include relying on the researcher to disseminate information about his or her research, attending conferences and workshops, working with industry to share information about emerging threats and research, and publishing journals to help facilitate information sharing.