In order to ensure the implementation of this framework, FISMA  assigns specific responsibilities to agencies, the Office of Management  and Budget (OMB), the National Institute of Standards and Technology  (NIST), and inspectors general:
Each agency is required to develop, document, and implement an  agency-wide information security program and to report annually to  OMB, selected congressional committees, and the U.S. Comptroller  General on the adequacy of its information security policies,  procedures, practices, and compliance with requirements. On February 12, 2013, the President issued an executive order on   Among other  improving the cybersecurity of critical infrastructure.things, it stated that the policy of the U.S. government is to increase the  volume, timeliness, and quality of cyber threat information shared with  U.S. private sector entities and ordered the following actions to be taken:
The Attorney General, the Secretary of Homeland Security, and the  Director of National Intelligence are, within 120 days of the date of the  order, to issue instructions for producing unclassified reports of cyber  threats and establish a process for disseminating these reports to  targeted entities. The directive calls for a number of specific implementation actions, along  with associated time frames, which include developing a description of  the functional relationships within DHS and across the federal  government related to critical infrastructure security and resilience;  conducting an analysis of the existing public-private partnership model;  identifying baseline data and system requirements for the efficient  exchange of information and intelligence; demonstrating a near real-time  situational awareness capability for critical infrastructure; updating the  National Infrastructure Protection Plan; and developing a national critical  infrastructure security and resilience research and development plan. The Federal Government Continues to Face Challenges in Effectively Implementing Cybersecurity

We and federal agency inspector general reports have identified  challenges in a number of key areas of the federal government’s  approach to cybersecurity, including those related to protecting the  nation’s critical infrastructure. Designing and implementing risk-based cybersecurity programs at  federal agencies. Shortcomings persist in assessing risks, developing  and implementing security controls, and monitoring results at federal  agencies. As a result, they have limited assurance that controls are in  place and operating as intended to protect their information resources,  thereby leaving them vulnerable to attack or compromise. Recently, some agencies have demonstrated improvement in  this area. Establishing and identifying standards for critical infrastructures. required by law or regulation to comply with specific cybersecurity  requirements. Moreover, sectors vary in the extent to which they are  Detecting, responding to, and mitigating cyber incidents. DHS has  made progress in coordinating the federal response to cyber incidents,  but challenges remain in sharing information among federal agencies and  key private-sector entities, including critical infrastructure owners. Difficulties in sharing information and the lack of a centralized information- sharing system continue to hinder progress. These strategy documents address aspects of the above-mentioned  challenge areas. However, as we noted in our February 2013 report, the government has  not developed an overarching national cybersecurity strategy that  synthesizes the relevant portions of these documents or provides a  comprehensive description of the current strategy. Nonetheless, these  actions do not fulfill the recommendation that an updated strategy be  prepared for the President’s approval. In addition to lacking an integrated strategy, the government’s current  approach to cybersecurity lacks key desirable characteristics of a national  strategy. In 2004, we developed a set of desirable characteristics that can  enhance the usefulness of national strategies in allocating resources,  defining policies, and helping to ensure accountability. Existing cybersecurity strategy documents have included selected  elements of these desirable characteristics, such as setting goals and  subordinate objectives, but have generally lacked other key elements. The missing elements include the following:  Milestones and performance measures. Roles and responsibilities. Cybersecurity strategy documents have  assigned high-level roles and responsibilities but have left important  details unclear. In addition, while the law gives OMB responsibility for oversight of federal  information security, OMB transferred several of its oversight  responsibilities to DHS. While OMB’s decision to transfer these  responsibilities is not consistent with FISMA, it may have had beneficial  practical results, such as leveraging resources from DHS. Additional legislation could clarify these  responsibilities. This strategy should also better ensure that federal  government departments and agencies are held accountable for making  significant improvements in cybersecurity challenge areas by, among  other things, clarifying how oversight will be carried out by OMB and other  federal entities. Such  legislation could clarify the respective responsibilities of OMB and DHS,  as well as those of other key federal departments and agencies. Cyberspace: United States Faces Challenges in Addressing Global  Cybersecurity and Governance.
Why GAO Did This Study

Federal government agencies and the nation's critical infrastructures have become increasingly dependent on computerized information systems and electronic data to carry out their operations. While creating significant benefits, this can also introduce vulnerabilities to cyber-threats. Pervasive cyber attacks against the United States could have a serious impact on national security, the economy, and public health and safety. The number of reported cyber incidents has continued to rise, resulting in data theft, economic loss, and privacy breaches. Federal law and policy assign various entities responsibilities for securing federal information systems and protecting critical infrastructures. GAO has designated federal information security as a high-risk area since 1997 and in 2003 expanded this to include cyber critical infrastructure protection.
GAO was asked to testify on its recent report on challenges facing the government in effectively implementing cybersecurity and the extent to which the national cybersecurity strategy includes desirable characteristics of a national strategy. In preparing this statement, GAO relied on the report, as well as related previous work.

What GAO Found

The federal government continues to face challenges in a number of key areas in effectively implementing cybersecurity; these challenge areas include the following, among others:
Designing and implementing risk-based cybersecurity programs at federal agencies. Shortcomings persist in assessing risks, developing and implementing security programs, and monitoring results at federal agencies. This is due in part to the fact that agencies have not fully implemented information security programs, resulting in reduced assurance that controls are in place and operating as intended to protect their information resources.
Establishing and identifying standards for critical infrastructures. Agencies with responsibilities for critical infrastructure have not yet identified cybersecurity guidance widely used in their respective sectors. Moreover, critical infrastructure sectors vary in the extent to which they are required by law or regulation to comply with specific cybersecurity requirements.
Detecting, responding to, and mitigating cyber incidents. Sharing information among federal agencies and key private-sector entities remains a challenge, due to, for example, the lack of a centralized information-sharing system. In addition, the Department of Homeland Security (DHS) has yet to fully develop a capability for predictive analysis of cyber threats.
The federal cybersecurity strategy has evolved over the past decade, with the issuance of several strategy documents and other initiatives that address aspects of these challenge areas. However, there is no overarching national cybersecurity strategy that synthesizes these documents or comprehensively describes the current strategy. In addition, the government's existing strategy documents do not always incorporate key desirable characteristics GAO has identified that can enhance the usefulness of national strategies. Specifically, while existing strategy documents have included elements of these characteristics--such as setting goals and subordinate objectives--they have generally lacked other key elements. These include milestones and performance measures to gauge results; costs of implementing the strategy and sources and types of resources needed; and a clear definition of the roles and responsibilities of federal entities. For example, although federal law assigns the Office of Management and Budget (OMB) responsibility for oversight of federal government information security, OMB recently transferred several of these responsibilities to DHS. This decision may have had practical benefits, such as leveraging additional resources and expertise, but it remains unclear how OMB and DHS are to share oversight of individual departments and agencies. Additional legislation could clarify these responsibilities. Further, without an integrated strategy that includes key characteristics, the federal government will be hindered in making further progress in addressing cybersecurity challenges.

What GAO Recommends

In its report, GAO recommended that an integrated national strategy be developed that includes milestones and performance measures; costs and resources; and a clear definition of roles and responsibilities. It also stated that Congress should consider clarifying federal cybersecurity oversight roles through legislation.