This year marks the 21st anniversary of when GAO  first designated information security as a government-wide high-risk area  in 1997. We expanded this high-risk area to include safeguarding the  systems supporting our nation’s critical infrastructure in 2003 and  protecting the privacy of personally identifiable information in 2015. Federal Law and Policy Provide DHS with Broad Authorities to Improve and Promote Cybersecurity

DHS has broad authorities to improve and promote cybersecurity of  federal and private-sector networks. Act of 2014, among other things, requires DHS to assess its  cybersecurity workforce. The National Cybersecurity Protection Act of 2014 codified the  role of the National Cybersecurity and Communications Integration  Center (NCCIC)—a center established by DHS in 2009—as the  federal civilian interface for sharing information concerning  cybersecurity risks, incidents, analysis, and warnings to federal and  non-federal entities, including owners and operators of information  systems supporting critical infrastructure. DHS Has Acted to Improve and Promote the Cybersecurity of Federal and Private- Sector Computer Systems, but Further Improvements Are Needed

We have reviewed several federal programs and activities implemented  by DHS that are intended to mitigate cybersecurity risk for the computer  systems and networks supporting federal operations and our nation’s  critical infrastructure. DHS has made important progress in  implementing these programs and activities. However, the department  needs to take additional actions to ensure that it successfully mitigates  cybersecurity risks on federal and private-sector computer systems and  networks. NCPS is intended to  provide intrusion detection and prevention capabilities to entities across  the federal government. DHS’s National Integration Center Generally Performs Required Functions but Needs to Evaluate Its Activities More Completely

In February 2017, we reported that NCCIC had taken steps to perform  each of its 11 statutorily required cybersecurity functions, such as being  a federal civilian interface for sharing cybersecurity-related information  with federal and nonfederal entities. However, as we reported, the extent to which NCCIC  adhered to the 9 principles when performing the functions was unclear  because the center had not yet determined the applicability of the  principles to all 11 functions. It also had not established metrics and  methods by which to evaluate its performance against the principles. Among other activities, these recommendations  called for the department to determine the applicability of the  implementing principles and establish metrics and methods for evaluating  performance; and address identified impediments. In February 2014, DHS launched the Critical Infrastructure Cyber  Community Voluntary Program to assist the enhancement of critical  infrastructure cybersecurity and to encourage adoption of the framework  across the critical infrastructure sectors. In addition, the department’s  NCCIC received and disseminated cyber-related information for public  and private-sector partners. Specifically, the SSAs for 12 sectors, including DHS  for 8 sectors, had not developed metrics to measure and report on the  effectiveness of their cyber risk mitigation activities or their sectors’  cybersecurity posture. As of April 2018, DHS has not  demonstrated that it has implemented these recommendations. DHS has taken Steps to Identify its Workforce Gaps; However, It Urgently Needs to Take Actions to Identify Its Position and Critical Skill Requirements

In February 2018, we reported that DHS had taken actions to identify,  categorize, and assign employment codes to its cybersecurity positions,  as required by the Homeland Security Cybersecurity Workforce  Assessment Act of 2014. Until it fully and effectively performs its cybersecurity  authorities and responsibilities, DHS’s ability to improve and promote the  cybersecurity of federal and private-sector networks will be limited. GAO, Information Security: DHS Needs to Enhance Capabilities, Improve  Planning, and Support Greater Adoption of Its National Cybersecurity  Protection System, GAO-16-294 (Washington, D.C.: Jan. 28, 2016).
Why GAO Did This Study

The emergence of increasingly sophisticated threats and continuous reporting of cyber incidents underscores the continuing and urgent need for effective information security. GAO first designated information security as a government-wide high- risk area in 1997. GAO expanded the high-risk area to include the protection of cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015.
Federal law and policy provide DHS with broad authorities to improve and promote cybersecurity. DHS plays a key role in strengthening the cybersecurity posture of the federal government and promoting cybersecurity of systems supporting the nation's critical infrastructures.
This statement highlights GAO's work related to federal programs implemented by DHS that are intended to improve federal cybersecurity and cybersecurity over systems supporting critical infrastructure. In preparing this statement, GAO relied on a body of work issued since fiscal year 2016 that highlighted, among other programs, DHS's NCPS, national integration center activities, and cybersecurity workforce assessment efforts.

What GAO Found

In recent years, the Department of Homeland Security (DHS) has acted to improve and promote the cybersecurity of federal and private-sector computer systems and networks, but further improvements are needed. Specifically, consistent with its statutory authorities, DHS has made important progress in implementing programs and activities that are intended to mitigate cybersecurity risks on the computer systems and networks supporting federal operations and our nation's critical infrastructure. For example, the department has:
issued cybersecurity related binding operational directives to federal agencies;
served as the federal-civilian interface for sharing cybersecurity related information with federal and nonfederal entities;
Framework for Improving Critical Infrastructure Cybersecurity ; and
Nevertheless, the department has not taken sufficient actions to ensure that it successfully mitigates cybersecurity risks on federal and private-sector computer systems and networks. For example, GAO reported in 2016 that DHS's National Cybersecurity Protection System (NCPS) had only partially met its stated system objectives of detecting and preventing intrusions, analyzing malicious content, and sharing information. GAO recommended that DHS enhance capabilities, improve planning, and support greater adoption of NCPS.
In addition, although the department's National Cybersecurity and Communications Integration Center generally performed required functions such as collecting and sharing cybersecurity related information with federal and non-federal entities, GAO reported in 2017 that the center needed to evaluate its activities more completely. For example, the extent to which the center had performed its required functions in accordance with statutorily defined implementing principles was unclear, in part, because the center had not established metrics and methods by which to evaluate its performance against the principles. Further, in its role as the lead federal agency for collaborating with eight critical infrastructure sectors including the communications and dams sectors, DHS had not developed metrics to measure and report on the effectiveness of its cyber risk mitigation activities or on the cybersecurity posture of the eight sectors.
GAO reported in 2018 that DHS had taken steps to assess its cybersecurity workforce; however, it had not identified all of its cybersecurity positions and critical skill requirements.
Until DHS fully and effectively implements its cybersecurity authorities and responsibilities, the department's ability to improve and promote the cybersecurity of federal and private-sector networks will be limited.

What GAO Recommends

Since fiscal year 2016, GAO has made 29 recommendations to DHS to enhance the capabilities of NCPS, establish metrics and methods for evaluating performance, and fully assess its cybersecurity workforce, among other things. As of April 2018, DHS had not demonstrated that it had fully implemented most of the recommendations.