To develop a strategy to reduce such risks, in 1996, the President established a Commission on Critical Infrastructure Protection. Specifically, evaluating the NIPC’s progress in developing analysis and warning capabilities is difficult because the federal government’s strategy and related plans for protecting the nation’s critical infrastructures from computer-based attacks, including the NIPC’s role, are still evolving. The entities involved in the government’s critical infrastructure protection efforts have not shared a common interpretation of the NIPC’s roles and responsibilities. In our report, we  recommend that, as the administration proceeds, the Assistant to the President for National Security Affairs, in coordination with pertinent executive agencies, establish a capability for strategic analysis of computer-based threats, including developing related methodology, acquiring staff expertise, and obtaining infrastructure data; require development of a comprehensive data collection and analysis framework and ensure that national watch and warning operations for computer-based attacks are supported by sufficient staff and resources; and clearly define the role of the NIPC in relation to other government and private-sector entities. Progress in Establishing Information-Sharing Relationships Has Been Mixed

Information sharing and coordination among private-sector and government organizations are essential for thoroughly understanding cyber threats and quickly identifying and mitigating attacks. Similarly, the NIPC and the FBI have made only limited progress in developing a database of the most important components of the nation’s critical infrastructures—an effort referred to as the Key Asset Initiative. The NIPC has been more successful in providing training on investigating computer crime to government entities, which is an effort that it considers an important component of its outreach efforts.
Why GAO Did This Study

The National Infrastructure Protection Center (NIPC) is an important element of the U.S.' strategy to protect the nation's infrastructures from hostile attacks, especially computer-based attacks. This testimony discusses the key findings of a GAO report on NIPC's progress in developing national capabilities for analyzing cyber threats and vulnerability data and issuing warnings, enhancing its capabilities for responding to cyber attacks, and establishing information-sharing relationships with governments and private-sector entities.

What GAO Found

GAO found that progress in developing the analysis, warning, and information-sharing capabilities has been mixed. NIPC began various critical infrastructure protection efforts that have laid the foundation for future governmentwide efforts. NIPC has also provided valuable support and coordination related to investigating and otherwise responding to attacks on computers. However, the analytical and information-sharing capabilities that are needed to protect the nation's critical infrastructures have not yet been achieved, and NIPC has developed only limited warning capabilities. An underlying contributor to the slow progress is that the NIPC's roles and responsibilities have not been fully defined and are not consistently interpreted by other entities involved in the government's broader critical infrastructure protection strategy. This report summarized an April report (GAO-01-323).