As systems become more integrated,  cyber threats will pose an increasing risk to national security, economic  well-being, and public health and safety. Cybersecurity incidents continue to impact entities across various critical  infrastructure sectors. Due to  increasing cyber-based threats and the persistent nature of information  security vulnerabilities, we have designated information security as a  government-wide high-risk area since 1997. We further expanded the information security high-risk area in 2015 to  include protecting the privacy of PII. To address these challenges, we have  identified 10 critical actions that the federal government and other entities  need to take (see figure 4). Address cybersecurity workforce management challenges. These include reviews of:
Federal Risk and Authorization Management Program (FedRAMP)  implementation, including an assessment of the implementation of the  program’s authorization process for protecting federal data in cloud  environments;  the Equifax data breach, including an assessment of federal oversight  of credit reporting agencies’ collection, use, and protection of  consumer PII;  the Federal Communication Commission’s Electronic Comment Filing  System security, to include a review of the agency’s detection of and  response to a May 2017 incident that reportedly impacted the system;
DOD’s efforts to improve the cybersecurity of its major weapon
DOD’s whistleblower program, including an assessment of the  policies, procedures, and controls related to the access and storage of  sensitive and classified information needed for the program;  IRS’s efforts to (1) implement security controls and the agency’s  information security program, (2) authenticate taxpayers, and (3)  secure tax information; and  the federal approach and strategy to securing agency information  systems, to include federal intrusion detection and prevention  capabilities and the intrusion assessment plan. Protecting Cyber Critical Infrastructure

The federal government has been challenged in working with the private  sector to protect critical infrastructure. For more information on this action area, see appendix XI. Continued Implementation of Our Recommendations Is Needed to Address Cybersecurity Weaknesses

In conclusion, since 2010, we have made over 3,000 recommendations to  agencies aimed at addressing the four cybersecurity challenges. Securing  these systems and data is vital to the nation’s security, prosperity, and  well-being. Until our recommendations are addressed  and actions are taken to address the four challenges we identified, the  federal government, the national critical infrastructure, and the personal  information of U.S. citizens will be increasingly susceptible to the  multitude of cyber-related threats that exist. High-Risk Series: An Update. As of August 2018, both recommendations had not yet  been implemented. However, we noted that this emerging technology  also presents new issues in areas such as information security,  privacy, and safety.
Why GAO Did This Study

Federal agencies and the nation's critical infrastructures—such as energy, transportation systems, communications, and financial services—are dependent on information technology systems to carry out operations. The security of these systems and the data they use is vital to public confidence and national security, prosperity, and well-being.
The risks to these systems are increasing as security threats evolve and become more sophisticated. GAO first designated information security as a government-wide high-risk area in 1997. This was expanded to include protecting cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015.
This report provides an update to the information security high-risk area. To do so, GAO identified the actions the federal government and other entities need to take to address cybersecurity challenges. GAO primarily reviewed prior work issued since the start of fiscal year 2016 related to privacy, critical federal functions, and cybersecurity incidents, among other areas. GAO also reviewed recent cybersecurity policy and strategy documents, as well as information security industry reports of recent cyberattacks and security breaches.

What GAO Found

GAO has identified four major cybersecurity challenges and 10 critical actions that the federal government and other entities need to take to address them. GAO continues to designate information security as a government-wide high-risk area due to increasing cyber-based threats and the persistent nature of security vulnerabilities.
GAO has made over 3,000 recommendations to agencies aimed at addressing cybersecurity shortcomings in each of these action areas, including protecting cyber critical infrastructure, managing the cybersecurity workforce, and responding to cybersecurity incidents. Although many recommendations have been addressed, about 1,000 have not yet been implemented. Until these shortcomings are addressed, federal agencies' information and systems will be increasingly susceptible to the multitude of cyber-related threats that exist.

What GAO Recommends

GAO has made over 3,000 recommendations to agencies since 2010 aimed at addressing cybersecurity shortcomings. As of August 2018, about 1,000 still needed to be implemented.