Consequently, the security of these systems and networks is essential to  protecting national and economic security, public health and safety, and  the flow of commerce. The Federal Government and Its Contractors Face an Evolving Array of Cyber-Based Threats

Risks to cyber-based assets can originate from unintentional and  intentional threats. Unintentional threats can be caused by, among other  things, defective computer or network equipment, and careless or poorly  trained employees. These threat sources make use of various techniques— or exploits—that  may adversely affect federal information, computers, software, networks,  and operations. These inherent advantages, combined  with the increasing sophistication of cyber tools and techniques, allow  threat actors to target government agencies and their contractors,  potentially resulting in the disclosure, alteration, or loss of sensitive  information, including PII; theft of intellectual property; destruction or  disruption of critical systems; and damage to economic and national  security. The deputy secretary was quoted as saying “it is a  significant concern that over the past decade, terabytes of data have  been extracted by foreign intruders from corporate networks of  defense companies” and that some of the data concerned “our most  sensitive systems.”

	The Federal Government Faces Ongoing Challenges in Its Approach to Cybersecurity

Given the risk posed by cyber threats and the increasing number of  incidents, it is crucial that the federal government take appropriate steps  to secure its systems and information. In particular, challenges remain in  the following key areas:
Designing and implementing risk-based cybersecurity programs  at federal agencies. Specifically, for fiscal year 2014, 19 of the 24  federal agencies covered by the Chief Financial Officers Act reported  that information security control deficiencies were either a material  weakness or a significant deficiency in internal controls over their  financial reporting. Moreover, inspectors general at 23 of the 24  agencies cited information security as a major management challenge  for their agency. Over the last several years, GAO and agency inspectors general have  made hundreds of recommendations to agencies aimed at improving their  implementation of information security controls. For example:
Addressing cybersecurity for building and access control  systems. In December 2014 we reported that DHS lacked a strategy  for addressing cyber risk to building and access control systems and  that its Interagency Security Committee had not included cyber threats to such systems in its threat report to federal agencies.Further, the General Services Administration (GSA) had not fully  assessed the risk of cyber attacks aimed at building control systems. In  August 2014 we reported that five of six agencies reviewed were  inconsistent in overseeing assessments of contractors’  implementation of security controls. In addition, six agencies we  reviewed had not fully developed comprehensive policies, plans, and  procedures to guide their incident-response activities. The agencies generally agreed with these recommendations. In December 2013 we reported that  eight federal agencies had inconsistently implemented policies and  procedures for responding to data breaches involving PII. Implementing security programs at small agencies. In June 2014  we reported that six small agencies (i.e., agencies with 6,000 or fewer  employees) had not fully implemented their information security  programs. Until federal agencies take actions to address these challenges— including implementing the hundreds of recommendations made by us  and inspectors general—federal systems and information, as well as  sensitive personal information about members of the public, will be at an  increased risk of compromise from cyber-based attacks and other threats. Information Security: Agencies Need to Improve Cyber Incident  Response Practices. Information Security: Agency Responses to Breaches of Personally  Identifiable Information Need to Be More Consistent. Cybersecurity: Challenges in Securing the Electricity Grid.
Why GAO Did This Study

Federal agencies, as well as their contractors, depend on interconnected computer systems and electronic data to carry out essential mission-related functions. Thus, the security of these systems and networks is vital to protecting national and economic security, public health and safety, and the flow of commerce. If information security controls are ineffective, resources may be lost, information—including sensitive personal information—may be compromised, and the operations of government and critical infrastructure could be disrupted, with potentially catastrophic effects. Federal law sets forth various requirements, roles, and responsibilities for securing federal agencies' systems and information. In addition, GAO has designated federal information security as a high-risk area since 1997.
GAO was asked to provide a statement summarizing cyber threats facing federal agency and contractor systems, and challenges in securing these systems. In preparing this statement, GAO relied on its previously published work in this area.

What GAO Found

Federal and contractor systems face an evolving array of cyber-based threats. These threats can be unintentional—for example, from equipment failure, careless or poorly trained employees; or intentional—targeted or untargeted attacks from criminals, hackers, adversarial nations, or terrorists, among others. Threat actors use a variety of attack techniques that can adversely affect federal information, computers, software, networks, or operations, potentially resulting in the disclosure, alteration, or loss of sensitive information; destruction or disruption of critical systems; or damage to economic and national security. These concerns are further highlighted by the sharp increase in cyber incidents reported by federal agencies over the last several years, as well as the reported impact of such incidents on government and contractor systems.
Because of the risk posed by these threats, it is crucial that the federal government take appropriate steps to secure its information and information systems. However, GAO has identified a number of challenges facing the government's approach to cybersecurity, including the following:
Implementing risk-based cybersecurity programs at federal agencies: For fiscal year 2014, 19 of 24 major federal agencies reported that deficiencies in information security controls constituted either a material weakness or significant deficiency in internal controls over their financial reporting. In addition, inspectors general at 23 of these agencies cited information security as a major management challenge for their agency.
Securing building and access control systems: GAO previously reported that the Department of Homeland Security lacked a strategy for addressing cyber risks to agencies' building and access control systems—computers that monitor and control building operations—and that the General Services Administration had not fully assessed the risk of cyber attacks to such systems.
Overseeing contractors: The agencies GAO reviewed were inconsistent in overseeing contractors' implementation of security controls for systems they operate on behalf of agencies.
Improving incident response: The agencies GAO reviewed did not always effectively respond to cybersecurity incidents or develop comprehensive policies, plans, and procedures to guide incident-response activities.
Responding to breaches of personally identifiable information: The agencies GAO reviewed have inconsistently implemented policies and procedures for responding to data breaches involving sensitive personal information.
Implementing security programs at small agencies: Smaller federal agencies (generally those with 6,000 or fewer employees) have not always fully implemented comprehensive agency-wide information security programs.
Until agencies take actions to address these challenges—including the hundreds of recommendations made by GAO and inspectors general—their systems and information will be at increased risk of compromise from cyber-based attacks and other threats.

What GAO Recommends

In its previous work, GAO has made numerous recommendations to agencies to assist in addressing the identified cybersecurity challenges.