Background Federal agencies depend on computerized information systems and electronic data to process, maintain, and report essential information, and to operate and control physical processes. Virtually all federal operations are supported by computer systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions and account for their resources without these cyber assets. Hence, the security of these systems and data is vital to public confidence and the nation’s safety, prosperity, and well-being. However, computer networks and systems used by federal agencies can be riddled with security vulnerabilities—both known and unknown. These systems are often interconnected with other internal and external systems and networks, including the internet, thereby increasing the number of avenues of attack. Cybersecurity incidents continue to impact federal entities and the information they maintain. According to DHS’s U.S. Computer Emergency Readiness Team (US-CERT), agencies reported 31,107 information security incidents in fiscal year 2018. These incidents involved several threat vectors, such as web-based attacks, phishing attacks, and the loss or theft of computer equipment, among others. These incidents and others like them can pose a serious challenge to economic, national, and personal privacy and security. Safeguarding federal computer systems has been a long-standing concern, with 2020 marking the 23rd anniversary since GAO first designated information security as a government-wide high-risk area. We expanded this high-risk area to include safeguarding the systems supporting our nation’s critical infrastructure in 2003, protecting the privacy of personally identifiable information in 2015, and establishing a comprehensive cybersecurity strategy and performing effective oversight in 2018. Most recently, we continued to identify federal information security as a government-wide high-risk area in our March 2019 high-risk update. Beginning in fiscal year 2015 and continuing through fiscal year 2019, we made approximately 1,700 information security related recommendations. These recommendations identified actions for agencies to take to strengthen their information security programs and technical controls over their computer networks and systems. Nevertheless, many agencies continue to be challenged in safeguarding their information systems and information, in part, because they have not implemented many of these recommendations. As of the end of September 2019, approximately 650 of our prior information security related recommendations had not been implemented. Federal Law and Policy Outline Key DHS Responsibilities in Securing Online Information and Systems DHS plays a key role in the cybersecurity posture of the federal government and in the cybersecurity of systems that support the nation’s critical infrastructures. Specifically, FISMA gave DHS responsibilities for administering the implementation of agency information security policies and practices for non-national security information systems, in consultation with OMB. One of DHS’s responsibilities is to issue binding operational directives to federal civilian agencies that align with OMB’s policies, principles, standards, and guidelines. These directives apply to the federal civilian agencies that fall under DHS’s FISMA authorities, but do not apply to national security systems or certain systems operated by the Department of Defense or the intelligence community. See appendix II for a list of agencies to which the directives apply. In introducing the authority to issue binding operational directives, the Senate report accompanying FISMA 2014 noted that OMB would continue to have federal information security enforcement responsibilities through its budget powers and its discretion in setting overarching information security policies. Accordingly, OMB has issued several memorandums regarding cybersecurity, including: OMB M-15-01, Fiscal Year 2014-2015 Guidance on Improving Federal Information Security and Privacy Management Practices, required DHS to perform regular scans of public facing segments of federal civilian agency networks for vulnerabilities on an ongoing basis, as well as in response to newly discovered vulnerabilities. OMB has since rescinded this memorandum and replaced it with guidance for fiscal year 2018-2019 (M-19-02). OMB M-15-13, Policy to Require Secure Connections Across Federal Websites and Web Services, requires that all publicly accessible federal websites and web services only provide services through a secure connection using hypertext transfer protocol secure (HTTPS). OMB M-19-02, Fiscal Year 2018-2019 Guidance on Federal Information Security and Privacy Management Requirements, provides agencies with guidance and deadlines to comply with FISMA and reaffirms the value of agencies identifying and prioritizing their high value assets (HVA) as directed by DHS and OMB. OMB M-19-03, Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program, expands the HVA program to support and provide guidance to both Chief Financial Officers Act (CFO Act) and non-CFO Act agencies in HVA identification, assessment, remediation, and incident response. Under M-19-03, an agency may designate federal information or a federal information system as a HVA when it falls under one or more of the following categories: Informational Value. The information, or the system that processes, stores, or transmits the information, is of high value to the federal government or its adversaries. Mission Essential. The agency that owns the information or information system cannot accomplish its primary mission essential functions, as approved in accordance with the National Continuity Policy, found in Presidential Policy Directive 40 (PPD-40), within expected timelines without the information or information system. Federal Civilian Enterprise Essential. The information or information system serves a critical function in maintaining the security and resilience of the federal civilian enterprise. DHS’s Roles and Responsibilities for Binding Operational Directives Several entities within DHS have responsibilities for the binding operational directives. The department’s Cybersecurity and Infrastructure Security Agency’s (CISA) Cybersecurity Division is the lead entity for initiating, developing, issuing and overseeing the implementation of the directives. CISA oversees the Federal Network Resilience (FNR) division and the National Cybersecurity and Communications Integration Center (NCCIC) in carrying out specific roles related to the directives. Federal Network Resilience. FNR manages the coordination process for the directives, and oversees implementation of required actions at federal civilian agencies. To do so, FNR collects initial recommendations for new directives, drafts the directives, conducts agency outreach, and tracks agencies’ implementation of the directives. FNR is to collaborate with OMB, NIST, the National Security Council, federal chief information officers (CIOs), and chief information security officers (CISOs) on cybersecurity risk management and operational governance and training; conduct operational assessments for agencies; and assist agencies in identifying areas to improve cybersecurity. National Cybersecurity and Communications Integration Center. NCCIC is the federal civilian coordinator for information sharing concerning cybersecurity risks, incidents, analysis, and warnings with federal and nonfederal entities. The National Cybersecurity Assessments and Technical Services (NCATS), a group within NCCIC, conducts automated network and vulnerability scans of federal civilian agencies’ internet-accessible systems to identify vulnerabilities and configuration errors. Based on these scans, NCATS produces weekly cyber hygiene reports for each agency. The weekly reports describe vulnerabilities detected, affected systems, and mitigation guidance. In addition to the weekly reports, since early June 2019, NCATS has provided agencies with daily notification of any newly detected critical and high severity vulnerabilities. NCATS also conducts reviews of agencies’ high value assets, including security architecture and risk and vulnerability assessments on an ongoing basis. Other Federal Entities Assist in Coordinating Binding Operational Directives In addition to the DHS components described previously, several other entities assist in coordinating the binding operational directive process. Specifically, DHS’s FNR division coordinates with: Chief information officers and the Federal CIO Council: Federal agencies’ CIOs and the council serve as a source of input for new directives. The council is the principal forum for improving agency practices related to the design, acquisition, development, modernization, use, sharing, and performance of federal information resources. Chief information security officers and the Chief Information Security Officer Council: Federal agencies’ CISOs and the council discuss pending directives. The CISO Council, which is a subcommittee of the Federal CIO Council, collaborates to share information, transfer knowledge, and develop a unified approach to address federal IT security challenges. Small Agency Council: Members discuss pending directives and the potential impacts on small agencies. The council is a voluntary management association representing about 80 small agencies. National Institute of Standards and Technology (NIST): NIST experts are to ensure that binding operational directives do not conflict with NIST standards and guidelines. NIST is responsible for developing standards and guidelines that include minimum information security requirements for federal agencies. To this end, NIST has issued guidance to agencies in implementing an information security program. For example, Security and Privacy Controls for Federal Information Systems and Organizations, NIST Special Publication 800-53, provides guidance to agencies on the selection and implementation of information security and privacy controls for systems. General Services Administration (GSA): GSA coordinates with DHS and OMB, on an as-needed basis, to align cybersecurity services offered in its commercial IT contracts with DHS requirements for assessments, penetration testing, and additional cybersecurity services available to agencies, particularly related to HVAs. Binding Operational Directives Address Known Cyber Threats, Risks, and Vulnerabilities DHS developed and issued eight binding operational directives from May 2015 through April 2019 to address known cyber threats, risks, and vulnerabilities. These directives instruct agencies to, among other things: mitigate critical vulnerabilities discovered by DHS’s NCCIC through its scanning of agencies’ internet-accessible systems; better secure their HVAs by participating in risk and vulnerability assessments (RVA) and security architecture reviews (SAR) conducted on their assets; and address several urgent vulnerabilities in network infrastructure devices identified in a NCCIC analysis report. Table 1 provides a list of the directives and their issuance dates. DHS Has Designed, but Not Fully Implemented, a Directive Process DHS designed a process to develop and oversee the binding operational directives, but it has not followed key components of the process. Specifically, DHS has not involved stakeholders early in directive development and has not consistently overseen agencies’ implementation of some directives through validation of reported results. DHS’s Process for Developing and Implementing Directives FISMA requires that DHS develop and oversee the implementation of binding operational directives to safeguard federal information and information systems from a known or reasonably suspected information security threat, vulnerability, or risk and to implement the policies, principles, standards, and guidelines developed by the director of OMB, such as OMB memoranda M-19-03 and M-19-02. Pursuant to FISMA, DHS designed and is using a draft process for developing and overseeing the implementation of cybersecurity binding operational directives. According to CISA officials, the department was to follow this process since issuance of the second directive on securing high value assets (BOD 16-01) in June 2016. In October 2017, DHS documented the process, which it has since updated. According to CISA officials, as of January 2020, this document was still in draft and was undergoing internal agency review. According to the draft process, DHS is to engage in five steps to develop and implement binding operational directives (as discussed below and in more detail in appendix III): 1. Identify a potential directive topic and determine the extent to which it needs to be addressed. DHS’s FNR is to identify topics for new directives from a wide variety of sources, including technical assessments, operational findings of cybersecurity issues, and discussions with external partners such as the Federal CIO Council, NIST, or OMB. FNR is to consider, among other things, whether or not a potential directive topic could be best addressed using the directive process, as well as considering its potential value and impact. Once a topic is identified, FNR officials are to conduct research on the topic and solicit feedback from stakeholders, such as DHS CISA representatives, federal agency chief information officers and chief information security officers, and relevant OMB, NIST, and GSA officials. Once the research is completed, FNR is to make a determination on whether to proceed in developing a directive. 2. Develop a draft directive, send it to relevant stakeholders for review, and obtain approval to issue it. After FNR officials develop the draft directive, they are to send it to relevant stakeholders (e.g. CISA, OMB, NIST, and the DHS Office of General Counsel) for a review of the scope and contents of the directives. FNR staff are to incorporate any feedback from stakeholders into the draft directive and then send it to the CISA director for approval and issuance. 3. Distribute the approved directive to all relevant agencies. FNR officials are to notify agencies of the directive’s issuance via an email and a telephone call within 24 hours of the signing of the directive. In addition, FNR may choose to publicly post the directive to the DHS website. After FNR distributes the directive, agencies are to begin to address the directive’s requirements. 4. Implement and report on agencies’ efforts and progress in addressing the directive requirements. A CISA team is to review agency compliance with the directive through directive-related scans and compliance checks. The team is to distribute scorecards that indicate agency compliance with the directive requirements. 5. Close out the directive. DHS is to close a directive after it has validated that all of the requirements listed in the directive have been completed by all federal executive branch departments and agencies; the directive is no longer necessary because it has been revoked, suspended, or codified into law; or the directive needs to be amended. DHS Has Not Coordinated with Key Stakeholders Early in the Development Process FISMA requires DHS to consult with NIST, consider NIST’s standards and guidelines, and ensure that the directives it plans to implement do not conflict with NIST’s established standards and guidelines. Consistent with this requirement, DHS’s draft process calls for CISA to coordinate with stakeholders, such as NIST and GSA, early in the directive identification process to incorporate their input as a necessary part of executing the directive process. CISA has not coordinated with key stakeholders early in the development process. According to NIST officials in the Information Technology Laboratory/Computer Security Division, which is responsible for working on directive issues, CISA coordinates with them to ensure that a new directive does not conflict with NIST guidance, but does not do so early in the process. Specifically, the NIST officials stated that often DHS did not reach out to NIST on the most recent directives until 1 to 2 weeks before they were to be issued, and then did not incorporate the NIST technical comments that were provided. As a result of the lack of timeliness in DHS’s outreach to NIST, the directives may not include all key technical considerations. In addition, CISA also has not coordinated with GSA on the directives early in the development process. For example, officials in GSA’s Office of the Chief Information Officer told us that CISA did not coordinate with them on vendor issues before the directive on email and web security was issued. CISA officials acknowledged that, in the past, the agency mainly relied on an ad hoc approach to coordination and did not always coordinate early in the planning process with stakeholders, including NIST and GSA, even though early coordination is called for in the current DHS process. CISA officials also explained that, in certain circumstances, they may need to accelerate the development process when a directive needs to be issued quickly due to elevated risk, such as the directive on addressing threats to network devices in response to a specific hacking threat. CISA officials told us that they have begun to have a more formalized coordination process with key stakeholders, including NIST and GSA. NIST officials also noted that DHS and NIST have started regular coordination meetings to discuss directive-related issues earlier in the process. Nevertheless, CISA has yet to determine when in the directives’ development—for example, during early development and at directive approval—coordination with specific entities should occur. Until CISA addresses this, a lack of effective coordination with stakeholders in the early stages of directives’ development process and later in implementation is likely. This could result in directives that do not fully address key technical considerations, leaving agency systems at risk of being exposed to threats or vulnerabilities. CISA Has Not Validated Agencies Actions on All Directives FISMA requires DHS to oversee agencies’ implementation of its binding operational directives. To do this, DHS has outlined a process for validating agencies’ reported results as part of the Close Out step of its directives process. As part of this process, CISA is supposed to validate that agencies have addressed all requirements before a directive is considered to be fully implemented. Guidance from OMB and executive orders also emphasize using a risk-based approach to information security. Specifically, to protect against cyber threats, agencies must make decisions about how to most effectively secure their systems and data, based on an assessment of the risks they face. CISA has not validated agencies’ actions on all five selected directives. Specifically, the agency validated the implementation of two directives by using cyber hygiene scanning and provided weekly reports to the 99 executive branch civilian agencies. However, for the three other directives, CISA relied on agencies to self-report implementation and did not independently validate that the requirements had been met. According to CISA officials, the agency had to rely on agency submissions for these three directives because many of the potentially impacted devices were inside the agencies’ networks and were not visible to CISA’s scans, or were weaknesses identified in specific information security processes that CISA could not assess via scanning. For example, one directive required agencies to address vulnerabilities in specified network infrastructure devices internal to the network and then report to CISA either (1) completion of the actions, or (2) a plan of actions and milestones to complete the actions. The officials added that it is the agency’s responsibility to manage its own plan of actions and milestones, including verifications, and that they are not able to independently validate all of the actions because of a lack of an automated mechanism to detect findings inside agency networks and the lack of resources to do manual assessments. While we recognize that CISA does not have the automated tools or capacity to independently validate every self-reported action taken by agencies to meet binding operational directive requirements, CISA can take a risk-based approach to validation. Guidance from OMB and executive orders emphasize risk-based approaches to information security. However, CISA did not take a risk-based approach, and it also did not have a strategy in place to check selected agency-reported actions to validate their completion. Without taking such an approach or having a strategy in place, the likelihood for requirements to not be completely or correctly addressed is increased. This could leave computer networks and systems used by federal agencies riddled with security vulnerabilities—both known and unknown. Binding Operational Directives Often Have Been Effective in Addressing Cybersecurity Risks, but DHS Faces Challenges in Fulfilling Directive Requirements Agencies’ implementation of the directives has resulted in improvements that better safeguard federal information systems from a known or reasonably suspected information security threat, vulnerability, or risk. For example, according to DHS and agency data, in response to the directive on Critical Vulnerability Mitigation (BOD 15-01), agencies were able to mitigate about 2,500 out of about 3,600 critical vulnerabilities within 30 days of detection. However, not all agencies had been able to address all the directives’ requirements within the required timelines established in four out of the five directives we reviewed. Moreover, DHS faced constraints in implementing the HVA program. Agencies and DHS cited a number of reasons for not fulfilling the requirements, including a lack of resources and technical expertise, as well as vendor constraints and operational issues. The five directives are discussed below and in more detail in appendix IV. Agencies Are Implementing Binding Operational Directives, but Not All Within Established Timelines The civilian executive branch agencies to which the five selected binding operational directives apply are implementing and reporting on the requirements as called for in the directives. These five directives identify specific requirements to address known cyber threats, risks, and vulnerabilities and time frames for agency compliance, as well as requirements regarding how agencies are to report their progress on implementation of each directive to DHS. However, not all agencies are doing so within the directives’ established timelines (see directive details that follow). BOD 15-01: Mitigation of Critical Vulnerabilities on Internet-Accessible Systems Has Improved Since the Directive’s Issuance Issued on May 21, 2015, BOD 15-01, Critical Vulnerability Mitigation directed agencies to mitigate critical vulnerabilities discovered by DHS’s NCCIC through cyber hygiene scans of agencies’ internet-accessible systems. Agencies were to mitigate critical vulnerabilities within 30 days of NCCIC’s notification. If agencies were unable to mitigate critical vulnerabilities within 30 days, they were to provide plans and status updates to DHS on a monthly basis until each vulnerability was fully addressed. According to DHS and agency data, since the directive issuance in 2015, the federal civilian agencies were able to mitigate about 2,500 out of about 3,600 critical vulnerabilities within 30 days of detection. Specifically, according to NCATS data, as of May 2018, the median number of days agencies were taking to mitigate critical vulnerabilities from the point of initial detection had been reduced from approximately 16 days (May 2015 to May 2016) to 6 days (from May 2017 to May 2018). In addition, the agencies increased the percentage of critical vulnerabilities closed within 30 days of initial detection, from about 58 percent (May 2015 to May 2016) to 85 percent (from May 2017 to May 2018). See table 2 for more information on the critical vulnerability mitigation timeframes. In its fiscal year 2017 report to Congress on federal cybersecurity directives, DHS reported that the agencies were able to address vulnerabilities more quickly due, in part, to DHS setting clear expectations and timelines regarding mitigating critical vulnerabilities through its directive. Prior to the directive, there was no requirement for patching critical vulnerabilities within a certain time frame. As a result of the faster vulnerability mitigation, agencies are reducing the time their systems and networks are exposed to the cybersecurity risks associated with critical vulnerabilities. In addition to the federal civilian agencies’ improvements in critical vulnerability mitigation, the 12 selected agencies showed improvement in the average time needed to mitigate critical vulnerabilities. Specifically, in the third year after the directive issuance, according to NCATS data, four of the 12 selected agencies reported no critical vulnerabilities and five agencies reported a reduction in the average time needed to mitigate them. For example, one agency reduced the time it took to mitigate critical vulnerabilities from about 60 days to about 17 days on average. Further, all of the 12 selected agencies increased the percentage of critical vulnerabilities closed within 30 days of initial detection, from about 61 percent (from May 2015 to May 2016) to about 90 percent (from May 2016 to May 2017). While all covered agencies did not always meet the 30-day requirement, their mitigations were validated by DHS and reached 87 percent compliance by 2017. Officials attributed the recent decline in percentage mitigated to a 35-day partial government shutdown. Figure 1 provides information on the percent of critical vulnerabilities agencies (federal civilian agencies and the 12 we reviewed) were able to mitigate within 30 days, as required under the directive. In April 2019, DHS rescinded BOD 15-01 and replaced it with BOD 19-02, Vulnerability Remediation Requirements for Internet-Accessible Systems. This directive expands the requirements for agencies from addressing only critical vulnerabilities to addressing both critical and high vulnerabilities. Agencies are now required to mitigate critical vulnerabilities within 15 days of the vulnerabilities being identified through NCATS scanning (rather than within 30 days, as previously required), and to mitigate high vulnerabilities within 30 days of identification. According to the directive, if agencies are not able to mitigate the identified vulnerabilities in the required timeframes, they are to submit a remediation plan to DHS outlining constraints, interim mitigation actions, and estimated completion dates. BOD 16-02: Federal Agencies Addressed Threats to Selected Network Infrastructure Devices, but Most Did Not Do So within the Established Timeline Issued on September 27, 2016, BOD 16-02, Threat to Network Infrastructure Devices, addressed several urgent vulnerabilities in network infrastructure devices identified in an August 2016 NCCIC report. The report identified a known threat across federal networks and provided technical mitigation solutions. Specifically, it addressed hacking tools targeting firewalls, Cisco Adaptive Security Appliance devices, and devices running Cisco Internetwork Operating System (specifically the integrity of its ROM Monitor program). This directive required agencies to perform all mitigation actions identified in the NCCIC analysis report within 45 days, and to report either full mitigation or provide a detailed plan explaining constraints preventing mitigation. Agencies that were unable to achieve full mitigation within 45 days were instructed to provide monthly status updates until full mitigation was completed across their networks. According to DHS’s March 2019 report to OMB, within 6 months of issuance, the federal civilian agencies were able to remediate approximately 50 percent of impacted devices through patching and through upgrading outdated software. CISA reported that agencies completed all requested actions by October 2018, which was 2 years past the deadline. According to CISA officials, agencies were not able to meet the timeline due to remediation challenges, such as replacing large amounts of end-of-life devices, replacing mission critical devices, and adjusting default configurations on impacted devices. While CISA did not independently validate agencies’ actions in addressing the vulnerabilities as the devices were internal to the network, CISA reported that agencies secured over 11,000 network infrastructure devices across the federal civilian government (see figure 2). In addition to the federal civilian agencies’ status, five of the 12 selected agencies reported full mitigation of the risks outlined in the directive requirements within the 45-day deadline (November 14, 2016). An additional five agencies did not report full mitigation within 45 days, but provided detailed plans of action and milestones to DHS every 30 days thereafter until full mitigation, as required. These five agencies had completion dates ranging from April 2017 to October 2018. The remaining two agencies were unable to demonstrate that they had completed the directive requirements. However, DHS reported that the covered federal civilian agencies were able to complete all actions associated with this directive by October 2018. BOD 17-01: Agencies Removed Risky Software Products from Their Information Systems in Response to a Stated Threat Issued on September 13, 2017, BOD 17-01, Removal of Kaspersky- branded Products, required federal civilian agencies to (1) determine whether the agency had Kaspersky-branded products on its information systems within 30 days (October 13, 2017); (2) develop a plan to remove such products from its information systems within 60 days (November 13, 2017); and (3) begin implementing its plan for removal within 90 days (December 13, 2017) and provide DHS with updates every 30 days until the products were fully removed from agency information systems. According to DHS’s fiscal year 2017 report to Congress, by April 2018, officials from federal civilian agencies had either attested that Kaspersky- branded products were not present on their information systems or removed such products, as required by the directive. Similarly, officials at the 12 selected agencies stated and reported that they performed the required analysis to identify the use or presence of Kaspersky-branded products and reported to DHS by the 30-day deadline (October 13, 2017). Of these, 10 agencies reported that they did not find the use or presence of Kaspersky-branded products in its information systems. One agency found Kaspersky-branded products in its systems but removed the product before the 60-day planning deadline. The remaining agency identified the use or presence of Kaspersky-branded products in its information systems and developed a detailed plan of action and provided status reports to DHS every 30 days until completion on December 6, 2017. Subsequently, these requirements were enacted into law in the National Defense Authorization Act for Fiscal Year 2018, which further prohibited federal agencies from using products and services developed or provided by Kaspersky Labs. BOD 18-01: Agencies Have Made Progress on Most Email and Web Security Requirements, but Many Have Yet to Fully Address the Requirements Issued on October 16, 2017, BOD 18-01, Enhance Email and Web Security, required agencies to implement specific security standards that have been widely adopted in industry to ensure the integrity and confidentiality of internet-delivered data, minimize spam, and better protect users who might otherwise fall victim to a phishing email that appears to come from a government-owned system. As such, this directive required several actions related to email and web security with three different due dates: within 90 days (by January 2018), within 120 days (by February 2018), and within 1 year (by October 2018). Tables 3 and 4 outline the email and web security requirements and appendix V provides more detailed information on these requirements. The federal civilian agencies had made significant progress in addressing individual email and web security requirements of the directive. However, few agencies had fully addressed all of the directive’s email and web security requirements for all domains. A domain is a unique identifying address assigned to an internet-accessible system such as .gov or dhs.gov, and an individual agency may have multiple domains. NCATS scans each agency domain and measures it against the individual email and web requirements. According to our analysis of NCATS’ May 2019 scanning data, the agencies were between about 83 to 99 percent complete in addressing each individual email and web requirement across all domains (see figure 3). Similarly, three of the 12 selected agencies, were 100 percent complete in addressing each individual email and web requirement for all domains. In addition, the remaining nine agencies’ domains were from about 82 to almost 100 percent complete in addressing the individual email and web requirements. However, according to NCATS’ March 2018 agency scanning data, only three of 83 agencies (4 percent) had fully addressed all of the directive’s email and web security requirements due within the 120 day deadline across all of their domains. Within 1 year of issuance, according to NCATS’ October 2018 scanning data, six of 83 agencies (7 percent) had fully addressed all directive requirements. According to NCATS’ May 2019 scanning data, three additional agencies fully addressed the requirements. However, three agencies had fallen out of compliance (leaving the total compliance rate at 7 percent). Compliance with the email and web security requirements was slightly better for the 12 selected agencies. According to NCATS’ March 2018 scanning data, one of the 12 selected agencies fully addressed the directive’s requirements due at the 120 day deadline (8 percent). Within 1 year of issuance, according to NCATS’ October 2018 scanning data, one additional agency fully addressed the requirements (17 percent). According to NCATS’ May 2019 scanning data, three of the 12 agencies fully addressed the requirements (25 percent). See figure 4 for details. One of the key challenges that agencies have experienced in implementing the directive’s email requirements is related to strengthening email security by disabling the 3DES weak email cipher. Specifically, according to CISA’s March 2019 report to OMB, more than 50 agencies are dependent on email vendors that do not allow agencies to disable the 3DES cipher. FNR officials stated that after several agencies informed them of having vendor constraints, DHS started to work with vendors on behalf of the agencies. As a result, DHS issued a temporary exception in September 2018, 7 months after the initial deadline, for those agencies encountering this vendor constraint. According to CISA’s March 2019 report to OMB, in February 2019, one of the vendors began retiring the weak email cipher 3DES, but has not set a firm timeline on when it will be fully retired. In a June report to OMB, DHS stated that another email vendor had released a tool that agencies could implement to address the requirement to remove the weak email cipher 3DES. As of the end of April 2019, seven of the 12 selected agencies were affected by this vendor issue. CISA officials noted that they are working with industry officials, including at a leadership level, to ensure they understand when 3DES will be fully disabled. Once that happens, CISA reported that they will provide agencies with any additional support needed to address vendor management issues and the associated email and web requirements. Additionally, FNR officials stated that many agencies struggled to implement a DMARC-related requirement on their systems due to its complexity. FNR officials noted that they have provided agencies with training through a non-profit organization and hosted a variety of outreach events, including presentations, to help agencies work through the complexity of implementing DMARC. BOD 18-02: Agencies Are Participating in DHS-led Assessments, but DHS and Agencies Have Not Been Able to Complete the Assessments and Mitigations in a Timely Manner Issued on May 7, 2018, the purpose of BOD 18-02, Securing High Value Assets, is to enhance DHS’s approach to secure the federal government’s high value assets (HVAs) from cybersecurity threats. It replaces an earlier directive and requires agencies to: 1. Identify and submit coordination points of contact for HVA assessments within 7 days of issuance of the directive. 2. Submit a current and prioritized HVA list inclusive of all agency components within 30 days of issuance of the directive and review the agency HVA list and provide quarterly updates to DHS. 3. Participate in DHS-led assessments of HVAs, if selected. 4. Ensure identified major or critical weaknesses are mitigated within 30 days of receipt of the risk and vulnerability assessment (RVA) reports and/or security architecture review (SAR); notify DHS that each identified weakness was addressed; and report the status of any remaining major or critical weaknesses to DHS every 30 days until full remediation. As stated earlier, in an RVA, the assessor uses a number of techniques to identify weaknesses in the security posture of a given HVA; for a SAR, the assessor analyzes the architecture of the HVA and develops recommendations for improving HVA security related to system design and interconnections. Techniques for RVA assessments can include network mapping, vulnerability scanning, phishing tests, wireless assessments, web application assessments, and database assessments. A SAR provides a holistic analysis of how an HVA’s individual security components integrate and operate, including how data is protected during operations. According to a DHS report to OMB, assessments can identify HVA weaknesses that require significant network design changes and extended timelines to resolve. In December 2018, OMB issued a memorandum that expanded the definitions of HVAs, instructed agencies to prioritize their HVAs, and instructed agencies to conduct assessments of HVAs as directed by DHS. Subsequently, CISA issued supplemental guidance for BOD 18- 02 that divided HVAs into three tiers based on criticality and impact. The guidance defined Tier 1 systems as systems of critical impact to both the agency and the nation; Tier 2 systems as ones that have a significant impact on both the agency and the nation; and Tier 3 systems as those with a high impact on the agency. In addition, the supplemental guidance outlined the following required reviews: Tier 1 HVAs require one RVA and one SAR to be led by DHS every 3 Tier 2 HVAs require one RVA and one SAR to be conducted by an independent assessor or third party every 3 years, and Tier 3 HVAs require one RVA and one SAR agency self-assessment every 3 years. In response to the directive and supplemental guidance, most of the federal civilian agencies have taken several steps to address the requirements, including identifying points of contact; submitting current and prioritized HVA lists, if appropriate; participating in DHS-led assessments if selected; and beginning to address identified weaknesses. Specifically, CISA’s October 2019 data showed that federal civilian agencies have reported a total of 851 HVAs (212 Tier 1 and 639 Tier 2 and Tier 3 systems). In addition, CISA’s October 2019 data showed that at the beginning of October 2019, DHS had conducted 61 assessments in fiscal year 2018 and 73 in fiscal year 2019. This includes a mix of both RVAs and SARs. DHS has also taken steps to identify major or critical weaknesses from the HVA assessments. Specifically, CISA’s October 2019 data showed that, as of the end of September 2019, the 134 assessments identified 196 major or critical weaknesses. DHS and the agencies have not completed the required assessments and mitigations consistent with OMB guidance and DHS policy. To address the review requirement for Tier 1 HVAs in accordance with the OMB and DHS-defined frequency of assessments, DHS should complete at least a total of 142 assessments a year. However, DHS completed only about half of the required annual assessments this year (with 73 assessments completed in fiscal year 2019). In addition, DHS has yet to issue the guidance, standards, and methodologies for Tier 2 or Tier 3 HVA assessments, which are to be conducted by third parties and agencies, respectively. As a result, agencies cannot begin conducting assessments for the remaining 639 HVA systems. Further, agencies have not been able to mitigate the identified weaknesses within the required timeframes. Specifically, CISA’s October 2019 data showed that of the 196 major or critical weaknesses identified government-wide, agencies were not able to mitigate 160 within the required initial 30-day time frame; 75 major or critical weaknesses were still not mitigated as of early October 2019. Similarly, for the 12 selected agencies we reviewed, CISA’s October 2019 data showed that as of early October, the department performed a total of 58 assessments, which resulted in the discovery of 86 major or critical weaknesses. However, 64 of these major or critical weaknesses were not mitigated within the required initial 30-day time frame, and 32 major or critical weaknesses were still not mitigated as of early October 2019. In addition to the above requirements, DHS established a government- wide performance metric for agencies to address 45 percent of critical/high severity weaknesses discovered through HVA assessments within 30 days of them being reported, as required by the directive. However, DHS reported that agencies were only addressing these weaknesses within 30 days about 30 percent of the time. According to DHS, this shortcoming is largely due to the variety and difficulty of weaknesses identified by affected agencies in each calendar quarter, as well as the different maturity levels of agencies in addressing these weaknesses. Further, the performance metric for addressing the HVA weaknesses is not fully aligned with the directive’s requirements. Specifically, while the directive states that agencies should address weaknesses within 30 days, the directive also states that if the senior accountable officer for risk management at the agency determines that a risk cannot be adequately addressed within 30 days, the agency must develop and submit a remediation plan to DHS for its review. However, DHS’s metric does not provide for such an option. In implementing this directive, DHS recognized the need to measure the extent to which agencies are addressing the requirements and, therefore, improving government-wide cybersecurity. However, without a performance metric that is aligned with the binding operational directive process DHS has established, it will be challenged in demonstrating the overall efficacy of a binding operational directive in achieving cybersecurity goals. Agencies Identified Challenges Meeting Directive Timelines While DHS Faced Constraints in Implementing the HVA Assessment Program Agency and DHS officials reported that agencies faced technical and resource challenges in addressing the various directive requirements within established timelines. This is consistent with challenges reported by officials at the 12 selected agencies. DHS has recognized these challenges and taken actions on them. However, DHS faces a variety of challenges in implementing the HVA program that remain outstanding. Agencies Reported Various Challenges in Meeting Timelines Agencies reported various challenges in addressing the directive requirements within the established timelines. The challenges included (1) outdated systems that require costly updates or replacements before they can be brought into full compliance; (2) the lack of specialized expertise to address technical requirements; (3) the complexity of achieving full DMARC compliance; and (4) general issues associated with addressing weaknesses in agency HVAs. To address the first and second challenges (outdated systems and specialized expertise), in its March 2019 report to OMB, DHS provided the following considerations for OMB: (1) examine agency budgets to ensure agencies are deploying all available resources and capabilities against threats to government networks and data; (2) provide supplemental funds to agencies to support implementation of current and future binding operational directives; and (3) examine agency budgets to ensure agencies are deploying all available resources to obtain specialized training for staff or to hire specialized skill sets. According to CISA officials, OMB has contacted agencies that listed budget as a constraint in their plan of action and milestones and is currently discussing how OMB can provide assistance. DHS has also provided support to agencies in addressing the third challenge on DMARC. For example, CISA officials stated that they offer webinars focused on DMARC implementation to those agencies that do not have necessary technical expertise. With regard to the fourth challenge on HVAs, DHS reported that agencies government-wide faced a variety of challenges in addressing the weaknesses in their HVA programs, including issues with network segmentation and vulnerability to phishing attacks. In general, according to DHS, these types of weaknesses may not be easy to address within the required 30 days because they require long term planning and training, system or device procurement, and system integration and testing. The 12 selected agencies concurred with DHS’s view of the challenges they faced in addressing outstanding weaknesses associated with their HVAs. For example, one agency reported an enterprise-level deficiency related to an HVA that requires significant changes to its network design, with a projected remediation timeline of over a year in its plan of action and milestones. Another agency stated that it was unable to fully address a critical weakness within the DHS 30-day timeline, but did develop a remediation plan for the weakness and reported its progress to DHS as appropriate. In addition, another agency reported that it did not fully address a weakness within 30 days and also did not submit the required monthly reports. DHS reported that it has established an HVA Community of Interest with federal civilian agencies to identify and promote best practices within agencies and improve the security and privacy posture of HVA systems. Continued support from OMB and DHS in addressing the technical and resource constraints facing the agencies in addressing the requirements set in the directives will allow agencies to react quickly, efficiently, and effectively to the requirements of the directives. DHS Has Encountered Challenges in Fulfilling Its Responsibilities for the HVA Assessment Program While OMB guidance and DHS policy are clear on DHS’s responsibilities and time frames for the directive on the HVA program (BOD 18-02), DHS has yet to complete its HVA activities in a timely manner. Specifically, the HVA program manager within CISA stated that the department did not have sufficient resources to do all of the required assessments. As noted earlier, thus far, DHS has only conducted about half of the annual assessments required in DHS’s own supplemental guidance. The official stated that the department was now reassessing the prioritization and planning process of the HVA program. Further, CISA officials reported that they do not expect to issue the guidance, standards, and methodologies on Tier 2 and 3 HVAs until at least the end of fiscal year 2020. However, agencies cannot begin conducting Tier 2 third-party or Tier 3 agency self-assessments on HVA systems until DHS develops and issues the guidance, standards, and methodologies for these reviews, potentially leaving these critical systems at risk. Moreover, a CISA official stated that DHS will need to work with GSA to add qualified contractors for Tier 2 assessments to the appropriate GSA contract vehicle. The official stated that there is an ongoing effort with GSA to get contractors for third-party assessments certified by DHS added to the GSA schedule. According to DHS officials from the HVA office, the department is now reassessing key aspects of the program. However, it does not have a schedule or plan for completing this reassessment, or to address outstanding issues on completing required assessments, identifying needed resources, and finalizing guidance to agencies and third parties. Without such a schedule and plan, agencies may continue to face prolonged cybersecurity threats. Conclusions Although DHS has designed a process to develop and oversee the implementation of binding operational directives, it is not following all the steps in the draft process. Specifically, the department has not involved key stakeholders, such as NIST and GSA, early in the process. Additionally, although guidance from OMB and executive orders emphasize risk-based approaches to information security, CISA did not take such an approach in validating selected agency-reported actions. Until DHS addresses the coordination and validation issues, the likelihood is increased that directives will not fully address key technical considerations and requirements are not fully addressed. Federal civilian agencies have made many significant improvements in cybersecurity by implementing the directives’ requirements. However, an important performance metric for addressing vulnerabilities identified by HVA assessments does not align with the process DHS has established. Further, DHS has only completed about half of the required assessments for fiscal year 2019. In addition, DHS does not plan to issue the guidance, standards, and methodologies on Tier 2 and 3 systems until at least the end of fiscal year 2020. Given these shortcomings, DHS has been reassessing key aspects of the HVA program. However, there was no schedule or plan for completing the HVA reassessment and for addressing the outstanding issues on completing the required assessments, identifying needed resources, and finalizing guidance for Tier 2 and 3 systems. Without such a schedule and plan, agencies may continue to face increased and prolonged cybersecurity threats. Recommendations We are making four recommendations to the Department of Homeland Security: The Secretary of Homeland Security should determine when in the directive development process—for example, during early development and at directive approval—coordination with relevant stakeholders, including NIST and GSA, should occur. (Recommendation 1) The Secretary of Homeland Security should develop a strategy to independently validate selected agencies’ self-reported actions on meeting binding operational directive requirements, where feasible, using a risk-based approach. (Recommendation 2) The Secretary of Homeland Security should ensure that the binding operational directive performance metric for addressing vulnerabilities identified by high value asset assessments aligns with the process DHS has established. (Recommendation 3) The Secretary of Homeland Security should develop a schedule and plan for completing the high value asset program reassessment and addressing the outstanding issues on completing the required high value asset assessments, identifying needed resources, and finalizing guidance for Tier 2 and 3 HVA systems. (Recommendation 4) Agency Comments and Our Evaluation We provided a draft of this report to DHS for review and comment. We also provided informational copies of the report to the other agencies involved in the review: OMB; NIST; the Departments of Education, the Interior, Justice, and the Treasury; the Federal Deposit Insurance Corporation; the Federal Retirement Thrift Investment Board; the General Services Administration; the National Aeronautics and Space Administration; the Securities and Exchange Commission; the Social Security Administration; and the Tennessee Valley Authority. In written comments (reproduced as appendix VI), DHS agreed with our recommendations and described steps planned or under way to address them. For example, in its written response, DHS noted that the department is working to formalize a risk-based strategy to validate agency results with an estimated completion date of September 30, 2020. It also added that the department is working with OMB to address the need for independent validation. DHS and NIST also provided technical comments on the draft report, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees and the Acting Secretary of Homeland Security. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6240 or at dsouzav@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VII. Appendix I: Objectives, Scope and Methodology Our objectives were to evaluate (1) the Department of Homeland Security’s (DHS) process for developing and overseeing the implementation of binding operational directives (directives) and (2) the effectiveness of the directives, including agencies’ implementation of directive requirements. To address our first objective, we reviewed DHS documentation, including its policies and process information related to departmental development, approval, and coordination of the directives. We also reviewed DHS written requirements and process for overseeing how agencies are implementing the directives. In addition, we reviewed requirements from law and guidance including the Federal Information Security Management Act of 2014 (FISMA), and memoranda from the Office of Management and Budget (OMB). We evaluated DHS’s process against these requirements. Further, we interviewed officials from DHS, OMB, and National Institute of Standards and Technology (NIST) to obtain their views and verify the information provided. To address our second objective we selected five binding operational directives that had active requirements at the time we were designing our review and analysis in December 2018. These were: BOD 15-01, Critical Vulnerability Mitigation Requirement for Federal Civilian Executive Branch Departments and Agencies’ Internet- Accessible System, issued May 21, 2015. (This directive was revoked and replaced by BOD 19-02, Vulnerability Remediation Requirements for Internet-Accessible Systems in April 2019.) BOD 16-02, Threat to Network Infrastructure Devices (designated as closed by DHS, March 2019), issued September 27, 2016 BOD 17-01, Removal of Kaspersky-branded Products, issued BOD 18-01, Enhance Email and Web Security, issued October 16, BOD 18-02, Securing High Value Assets, issued May 7, 2018 We then randomly selected a sample of 12 agencies from the civilian executive branch agencies, to which DHS directives apply, to determine the extent to which these agencies have taken steps to address the directives’ requirements. Specifically, we randomly selected agencies from among those that had reported actual cybersecurity expenditures of over $30 million in fiscal year 2017 (the most recent data available at the time we began our review). The 12 selected agencies were (1) Department of Education; (2) Department of Homeland Security; (3) Department of the Interior; (4) Department of Justice; (5) Department of the Treasury; (6) Federal Deposit Insurance Corporation; (7) Federal Retirement Thrift Investment Board; (8) General Services Administration; (9) National Aeronautics and Space Administration; (10) Securities and Exchange Commission; (11) Social Security Administration; and (12) Tennessee Valley Authority. We developed a data collection instrument based on the directives’ requirements. We administered the data collection instrument to the selected agencies and collected supporting documentation, such as compliance reports, corrective plans of action/plans of actions and milestones, and remediation plans and responses to the requirements outlined in five directives (15-01, 16-02, 17-01, 18-01, and 18-02). In addition, we reviewed the directives and other relevant requirements as well as DHS’s process for evaluating agency actions to address the requirements and to develop binding operational directive-related performance metrics. We also reviewed DHS’s fiscal years 2018 and 2019 annual performance reports and quarterly performance report updates, fiscal year 2019 reports to OMB, and fiscal years 2016 and 2017 reports to Congress on agencies’ (government-wide) implementation status of binding operational directives. We assessed steps DHS was taking to measure agencies’ performance against DHS’s established metrics. Specifically, we reviewed the 99 civilian executive branch agencies’ and 12 selected agencies’ performance against the specific directives requirements. We analyzed agency documentation, including status reports and plans of action and milestones, as well as scanning data from the National Cybersecurity and Communications Integration Center for both selected agencies and government-wide. We also reviewed DHS performance reports regarding the extent to which DHS’s government-wide performance metrics for mitigation of vulnerabilities on internet-facing systems and for closure of certain vulnerabilities on high value assets align with agencies’ existing requirements from OMB and DHS, such as closure timelines of selected types of vulnerabilities and weaknesses. We compared these performance reports and metrics with existing requirements found in DHS’s directives to assess whether they were aligned. In addition, we reviewed detailed scanning data and output from a data analysis tool from DHS’s database to determine the extent to which the 99 civilian executive branch agencies and our selected 12 agencies are mitigating vulnerabilities on internet-accessible systems and whether or not they are being mitigated within given timeframes. In addition, to analyze the implementation of email and web security requirements, we reviewed detailed scanning data on the status of the 99 civilian executive branch agencies and our selected 12 agencies. To assess the reliability of the scanning data and related DHS analysis that we used to support the findings in this report, we interviewed agency officials to determine the steps taken to ensure the integrity and reliability of the data and reviewed relevant documentation to substantiate the evidence obtained through interviews with agency officials. We determined that the data used in this report were sufficiently reliable for the purposes of our reporting objectives. We supplemented our analyses with interviews of DHS and selected agency officials to obtain their views on the steps they have taken to address the directives’ requirements. We conducted this performance audit from October 2018 to February 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: List of Federal Agencies to Which Binding Operational Directives Apply Appendix III: Binding Operational Directives Process Within the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency’s Cybersecurity Division, the Federal Network Resilience (FNR) is responsible for managing the process for developing and overseeing the binding operational directives, including coordination and implementation. The process is documented in the department’s draft Cybersecurity Division Binding Operational Directives Process and outlines five steps and their substeps: Step 1: Identify and Determine. This step includes three substeps—1.1 triggers, 1.2 business case development, and 1.3 socialization. The identification of a directive begins with a trigger that identifies a particular topic. The trigger may be from an administrative priority, technical assessment, operational finding, or discussions with external entities such as the Federal Chief Information Officer Council, National Institute of Standards and Technology (NIST), Office of Management and Budget (OMB) or a private sector organization. Once a topic is identified, FNR officials conduct research on the topic and solicit feedback from stakeholders. FNR then directs topics to the Binding Operational Directives Discussion Group. According to the draft process, recommended members of this group include representatives from Cybersecurity and Infrastructure Security Agency (CISA) and ad hoc and external partners, such as OMB officials, federal CIOs and chief information security officers (CISO), NIST officials, and General Services Administration officials. During substep 1.1, the group should decide whether to proceed to substep 1.2, business case development for a directives’ topic. The group maintains an online repository for proposed topics, active directives, and topics that have been previously considered, but archived for future use or historical documentation purposes. During business case development, a lead within the discussion group researches risks, threat actors, and mitigation strategies. The group incorporates information from subject matter experts and programs that provide information on current threats facing agencies and mitigation actions (e.g., Continuous Diagnostics and Mitigation and EINSTEIN). Once drafted, the business case is sent to FNR leadership, such as the Director and Deputy Director, for review. In the socialization substep 1.3, the discussion group may obtain additional feedback through various outreach efforts or through CIO, or CISO Council meetings. Step 2: Develop and Approve. This step includes two substeps—2.1 table top and 2.2 BOD material finalization. In step 2, FNR staff draft the directive. A table top exercise is an optional step that FNR staff may take to test required actions at selected agencies. As part of drafting the directive, the FNR staff coordinates with stakeholders, such as National Cybersecurity Assessments and Technical Services (NCATS), OMB and selected other agencies to develop an action plan template. This template instructs agencies on how to track and submit their progress on a particular directive. In addition, the team drafts a communications plan to disseminate directive-related information to agencies and the public. During substep 2.2, BOD material finalization, the action plan template and communications plan are sent along with the draft directive to all associated stakeholders (e.g. FNR, OMB, NIST, and Department of Homeland Security (DHS) Office of General Counsel) for review. After FNR staff incorporate any additional feedback, the draft directive package is then sent to the CISA Director for signature and then release. Step 3: Distribute. This step includes three substeps—3.1 notification, 3.2 baseline evaluation delivery, and 3.3 begin mandatory actions. According to FNR officials, the approval of a directive is the start of several processes in this step. During substep 3.1, all affected federal civilian agencies receive notification through an email and a directive issuance call within 24 hours of the signing of the directive. In addition, the DHS website (cyber.dhs.gov) and the OMB MAX portal may post the directive depending on the content of the directive. The notification of the directive is followed with agency baseline evaluation delivery, substep 3.2. As part of this substep, the validation team, including representatives from NCATS, may deliver baseline evaluations to provide agencies a better understanding of where they stand in addressing the directive prior to issuance, depending on the nature of the directive. In the last substep 3.3, agencies begin mandatory actions as noted in the directive. Step 4: Implement and Report. This step includes three substeps—4.1 action plan submission, 4.2 continuous coordination, and 4.3 implementation and reporting. The step begins with FNR’s establishment of a Binding Operational Directives Implementation Team to manage the requirements of a specific directive. This team includes a technical lead who reviews and tracks agency plan submissions as part of substep 4.1; a validation team whose members validate agency compliance with the directive; and a data analyst, who is to compile all agency-submitted action plans and draft a monthly status report. According to the draft process document, the validation team conducts directive-related scans and compliance checks, and develops and distributes scorecards that indicate agency compliance with directive requirements. For some directives, such as BODs 16-02, 17-01, and 18- 02, DHS relied on agency self-reporting to confirm that an agency had addressed the requirements, and the validation team did not verify compliance. During substep 4.2 FNR staff and the affected agency maintain continuous coordination through email and phone conversations to address any challenges involved with implementing the directive. Substep 4.3 implementation and reporting consists of processes agencies may need to establish internally to address and report on directive requirements until completion, such as points of contact and methods of communication with FNR. The implementation team produces monthly status reports for FNR leadership, such as the Director and Deputy Director, showing which agencies have complied or not complied with directive requirements. Based upon this information, FNR officials decide whether to escalate instances of agency noncompliance. In addition, FNR officials stated that they have a monthly check-in with OMB, during which they provide status reports as well as conduct less formal weekly discussions. For Congress, CISA produces an annual binding operational directives’ implementation report, in addition to responding to more frequent congressional information requests. To date, DHS has submitted two congressional reports for fiscal year 2016 and 2017. According to FNR officials, as of September 2019, the fiscal year 2018 report is undergoing OMB review. Step 5: Close Out. This step includes two substeps—5.1 results validation and 5.2 setting a higher bar. The draft process document describes the following scenarios that may lead to results validation; if a directive: (1) has been completed by all agencies; (2) is no longer necessary because it has been revoked, suspended, or codified into law; or (3) needs to be amended. In the first scenario, once the validation team affirms that the requirements have been met, FNR officials are to notify affected federal agency officials that their agencies have fulfilled all requirements. FNR officials then draft a binding operational directive completion letter that the Secretary of DHS or the Secretary’s designee signs. According to FNR officials, a directive does not fully close out after the Secretary signs a completion letter, because the directive is still in effect even after agencies have fulfilled all of the particular directive’s requirements. If a directive is revoked or amended, FNR officials draft a letter noting the reasons for such actions which the Secretary of DHS then signs. Agencies are expected to adhere to the newly implemented requirement, which is how DHS describes substep 5.2, setting a higher bar. Figure 1 provides the life cycle of a binding operational directive. Appendix IV: Binding Operational Directives and Associated Requirements The Department of Homeland (DHS) had issued eight binding operational directives (BOD) as of October 2019. A full list of DHS’s directives’ numbers and titles with a summary of their corresponding DHS and agency requirements follows. BOD 15-01− Critical Vulnerability Mitigation Requirement for Federal Civilian Executive Branch Departments and Agencies’ Internet- Accessible Systems, May 21, 2015 Agency Requirements Agencies or departments are to: Review and mitigate the critical vulnerabilities on their internet facing systems identified by DHS’s National Cybersecurity and Communications Integration Center within 30 days of issuance of agencies’ weekly cyber hygiene reports. Within 30 days will provide a detailed justification to DHS outlining any barriers, planned steps for resolution, and a time frame for mitigation, if unable to mitigate vulnerability. DHS Requirements DHS’s Federal Network Resilience Division will work directly with the department or agency to attempt to assist or address any constraints limiting expedited resolution of the vulnerability. DHS’s NCCIC will leverage weekly agency scans to track each department or agency’s progress in mitigating its critical vulnerabilities. DHS will provide quarterly cyber hygiene report updates to the OMB to ensure department and agency results are synchronized with OMB cybersecurity oversight initiatives. BOD 16-01−Securing High Value Assets, June 9, 2016 Agency Requirements Agencies or departments are to: Identify and submit the name of a lead point of contact to DHS’s FNR branch within 7 days of this directive’s issuance. The point of contact will be responsible for coordinating the agency’s high value asset assessments with DHS. (Submission of the same information for at least one backup point of contact is encouraged.) Participate in assessments, mitigation, and remediation activities by: Signing a DHS-provided rules of engagement document authorizing DHS to conduct risk and vulnerability assessments on agency high value assets. Beginning to implement DHS-issued mitigation measures listed in this directive’s appendix for agency high value assets Participating in the high value asset assessments authorized by the rules of engagement. Participating in a security architecture assessment for select high value assets, if requested to do so by DHS. Mitigating the high-priority vulnerabilities identified by DHS in the high value asset final assessment report within 30 days of DHS’s receipt of the report or determine that mitigation is not feasible within that time frame. Providing additional status updates every 30 days until all high- priority vulnerabilities have been addressed. DHS Requirements DHS will identify agency high value assets for assessment and report their findings to agencies. DHS will validate whether any relevant protections have been appropriately implemented during each high value asset assessment and will provide the agency with a report on the extent of sufficient implementation. If an agency does not comply with the requirements of this binding operational directive, DHS will follow up with each deputy secretary or equivalent, as appropriate. BOD 16-02−Threat to Network Infrastructure Devices, September 27, 2016 Agency Requirements Agencies or departments are to: Perform all actions in the Solution sections of the technical annexes to the NCCIC Analysis Report AR-16-20173 no later than 45 days after issuance of this directive. Report to DHS, through the OMB MAX Connect Portal, either full mitigation or provide a detailed plan of action and milestones explaining the constraints preventing mitigation and the associated compensating controls established no later than 45 days after issuance of this directive. Provide additional reports or plans of action and milestones every 30 days thereafter until full mitigation is achieved. DHS Requirements DHS’s NCCIC will continue to analyze information for additional mitigation steps to protect federal networks and will develop technical annexes in the future under this directive as necessary. If an agency does not comply with the requirements of this directive, DHS will follow up with each deputy secretary or equivalent, as appropriate. Perform all actions in the Solution sections of the technical annexes to the NCCIC Analysis Report AR-16-20173 no later than 45 days after issuance of this directive. Report to DHS, through the OMB MAX Connect Portal, either full mitigation or provide a detailed plan of action and milestones explaining the constraints preventing mitigation and the associated compensating controls established no later than 45 days after issuance of this directive. Provide additional reports or plans of action and milestones every 30 days thereafter until full mitigation is achieved. BOD 16-03−2016 Agency Cybersecurity Reporting Requirements, October 17, 2016 Agency Requirements Agencies or departments are to: Report security incidents to the DHS United States Computer Emergency Readiness Team in accordance with the guidelines found at https://www.us-cert.gov/incident-notification-guidelines, which are updated as necessary. Include metric information from the chief information officer, inspector general, and senior agency official for privacy, detailed in the annual FISMA metrics, in the Fiscal Year 2016 Annual Federal Information Security Management Act Reports, found at https://www.dhs.gov/publication/fy16-fisma-documents. Submit CIO, IG, and privacy metrics by November 10, 2016, to OMB and DHS via CyberScope. View the Fiscal Year 2017 Annual FISMA CIO metrics available at https://www.dhs.gov/publication/fy17-fisma-documents and plan accordingly so they can include these metrics in their Fiscal Year 2017 FISMA Reports. DHS Requirements DHS will track submission of Fiscal Year 2016 Annual Federal Information Security Management Act Reports and privacy metrics, and follow up with OMB or the relevant agency to address non-compliance as appropriate. BOD 17-01−Removal of Kaspersky-branded Products, September 13, 2017 Agency Requirements Agencies or departments are to: Within 30 calendar days after issuance of this directive, identify the use or presence of Kaspersky-branded products on all federal information systems and provide a report to DHS that includes: A list of Kaspersky-branded products found on agency information systems. If agencies do not find the use or presence of Kaspersky-branded products on their federal information systems, they should inform DHS that no Kaspersky- branded products were found. The number of endpoints impacted by each product. The methodologies employed to identify the use or presence of the products. Within 60 calendar days after issuance of this directive, develop and provide to DHS a detailed plan of action to remove and discontinue present and future use of all Kaspersky-branded products beginning 90 calendar days after issuance of this directive. Agency plans must address the following elements: Agency name. Point of contact information, including name, telephone number, and email address. List of identified products. Number of endpoints impacted. Methodologies employed to identify the use or presence of the products. List of agencies (components) impacted within department. Mission function of impacted endpoints and/or systems. All contracts, service-level agreements, or other agreements the agency has entered into with Kaspersky. Timeline to remove identified products. If applicable, FISMA performance requirements or security controls that product removal would impact, including, but not limited to data loss/ leakage prevention, network access control, mobile device management, sandboxing/detonation chamber, web site reputation filtering/web content filtering, hardware and software whitelisting, vulnerability and patch management, anti- malware, anti-exploit, spam filtering, data encryption, or other capabilities. If applicable, chosen or proposed replacement products/capabilities. If applicable, timeline for implementing replacement products/ capabilities. Foreseeable challenges not otherwise addressed in this plan. Associated costs related to licenses, maintenance, and replacement (coordinate with agency chief financial officers). At 90 calendar days after issuance of this directive, and unless directed otherwise by DHS based on new information, departments or agencies will begin to implement the agency plan of action and provide a status report to DHS on the progress of that implementation every 30 calendar days thereafter until full removal and discontinuance of use is achieved. DHS Requirements DHS will rely on agency self-reporting and independent validation measures for tracking and verifying progress. DHS will provide additional guidance through the federal cybersecurity coordination, assessment, and response protocol following the issuance of this directive. BOD 18-01− Enhance Email and Web Security, October 16, 2017 Agency Requirements Agencies or departments are to: Within 30 calendar days after issuance of this directive, develop and provide to DHS an agency plan of action for BOD 18-01 to: Enhance email security by configuring within 90 days after issuance of this directive: All internet-facing mail servers to offer STARTTLS, and All second-level agency domains to have valid sender policy framework (SPF)/domain-based message authentication, reporting and conformance (DMARC) records, with at minimum a DMARC policy of “p=none” and at least one address defined as a recipient of aggregate and/or failure reports. Within 120 days after issuance of this directive, ensuring: Secure sockets layer (SSL)v2 and SSLv3 are disabled on mail Triple data encryption standard (3DES) and Rivest cipher 4 (RC4) ciphers are disabled on mail servers (see temporary policy exception for 3DES). Within 15 days of the establishment of centralized NCCIC reporting location, adding the NCCIC as a recipient of DMARC aggregate reports. Within 1 year after issuance of this directive, setting a DMARC policy of “reject” for all second-level domains and mail-sending hosts. Enhance web security by: Within 120 days after issuance of this directive, ensuring: All publicly accessible federal websites and web services provide service through a secure connection (hypertext transfer protocol secure (HTTPS)-only, with HTTP strict transport security (HSTS)), SSLv2 and SSLv3 are disabled on web servers, and 3DES and RC4 ciphers are disabled on web servers. Identifying and providing a list to DHS of agency second-level domains that can be HSTS preloaded, for which HTTPS will be enforced for all subdomains. Upon delivery of its plans of action for BOD 18-01, within 30 days of this directive, departments or agencies will begin implementing their plans. At 60 calendar days after issuance of this directive, departments or agencies will provide a report to DHS on the status of that implementation. They will continue to report every 30 calendar days thereafter until implementation of the agency’s BOD 18-01 plan is complete. DHS Requirements DHS will review each agency plan of action for BOD 18-01 after receipt and may contact agencies with concerns. DHS will coordinate the agency-provided lists of domains for HSTS preloading with DotGov. DHS will rely on scanning by its National Cybersecurity Assessments and Technical Services team for tracking and verifying progress with agency compliance with this directive. DHS will notify agencies when the NCCIC establishes a central location for the collection of agency DMARC aggregate reports DHS will provide additional guidance through a DHS coordination call and other engagements and products following the issuance of this directive. BOD 18-02− Securing High Value Assets, May 7, 2018 Agency Requirements Agencies or departments are to: Identify and submit coordination points of contact (POC) for high value asset assessments. If selected to participate in DHS-led HVA assessment, departments or agencies will complete and submit to DHS a single rules of engagement (ROE), and for each HVA and related system(s) to be assessed, one ROE Appendix A titled “Risk and Vulnerability Assessment (RVA) Services for High Value Assets and Related Systems,” authorizing DHS to conduct HVA RVAs on that agency HVA and related systems. Participate in the HVA assessments authorized by the ROE and one or more Appendix A submissions for “RVA Services for High Value Assets and Related Systems.” Participate in a security architecture review (SAR) of each HVA to be assessed. Impose no restrictions on the timing and/or frequency of the assessments, the services to be provided by DHS, or the scope of systems that are part of or related to the HVA being assessed. Ensure timely remediation of identified vulnerabilities and report Within 30 days of receipt of the RVA and/or SAR reports identifying major or critical weakness to an assessed HVA, remediate all major or critical weaknesses and provide notification to DHS that each identified weakness was addressed. If it is determined by the designated senior accountable official for risk management that full remediation cannot be completed within the initial 30-day time frame, develop and submit to a designated DHS email address, a remediation plan for each HVA with remaining major or critical weaknesses within 30 days of the receipt of the RVA and/or SAR reports. This remediation plan shall include justification for the extended timeline, the proposed timeline and associated milestones to remediation (not to exceed 1 year), interim mitigation actions planned to address immediate vulnerabilities, and, if relevant, the identification of constraints related to policy, budget, workforce, and operations. This remediation plan must be signed by the designated senior accountable official for risk management prior to submission to DHS. Report the status of each remaining major or critical weakness to a designated DHS email address every 30 days until full remediation is achieved for all assessed HVAs. Status reports must address RVA and SAR results through combined reporting and must be submitted every 30 days starting 30 days after the submission of the remediation plan described above. Notify DHS at a designated email address and through the monthly status reports of any modifications to remediation plan timelines and when full remediation has been achieved. The notifications for modifications and full remediation must be certified under signature of the designated senior accountable official for risk management. DHS Requirements DHS will centrally manage agency progress and report submissions, and will engage each agency head in all cases where the agency has not met the deadlines outlined in the agency/department required actions list. DHS collects, maintains, and prioritizes agency-submitted HVAs, and will notify enterprise chief information officers, chief information security officers, and HVA points of contact of specific HVAs selected for DHS-led assessments based on OMB-led determinations. DHS maintains all agency HVA submissions on HSIN. DHS provisions HSIN accounts for designated agency HVA POCs and provides instruction on HSIN use, as needed. DHS provides standard templates for identifying and submitting agency HVAs and for remediation plans and progress reports. DHS plans and conducts RVAs and SARs for OMB-selected agency HVAs, and provides formal reports containing assessment findings and recommendations to the designated agency HVA POCs. BOD 19-02− Vulnerability Remediation Requirements for Internet Accessible Systems, April 29, 2019 Agency Requirements Agencies or departments are to: Ensure access and verify scope. Ensure cyber hygiene scanning access by removing cyber hygiene source internet protocol (IP) addresses from block lists. Within 5 working days of the change, notify the Cybersecurity and Infrastructure Security Agency (CISA) at a designated email address of any modifications to the agency’s internet-accessible IP addresses. This includes newly acquired internet-accessible IP addresses or re-assigned internet-accessible IP addresses that are no longer part of the agency’s asset inventory. Upon request from CISA, departments or agencies will submit updated cyber hygiene agreements to a designated DHS email address. Review and remediate critical and high vulnerabilities. Review cyber hygiene reports issued by CISA and remediate the critical and high vulnerabilities detected on the agency’s internet- accessible systems as follows: Critical vulnerabilities must be remediated within 15 calendar days of initial detection. High vulnerabilities must be remediated within 30 calendar days of initial detection. DHS Requirements CISA will monitor federal agency progress and will engage agency senior leadership, such as the chief information security officer, the chief information officer, and the senior accountable officer for risk management, as necessary and appropriate, when the agency has not met the required agency action deadlines specified. CISA also will track the remediation of critical and high vulnerabilities through persistent cyber hygiene scanning and will validate compliance with the directive requirements through these reports. CISA will provide regular reports to federal civilian agencies on cyber hygiene scanning results and current status, and a federal enterprise scorecard report to agency leadership. CISA will provide standard remediation plan templates for federal civilian agencies to populate if remediation efforts exceed required time frames. CISA will engage agency POCs to discuss agency status and provide technical expertise and guidance for the remediation of specific vulnerabilities, as requested and appropriate. CISA will engage agency chief information security officer, the chief information officer, and the senior accountable officer for risk management, throughout the escalation process, if necessary. CISA will provide monthly cyber hygiene reports to OMB to identify cross-agency trends, persistent challenges, and facilitate potential policy and/or budget-related actions and remedies. The report will also ensure alignment with other OMB-led cybersecurity oversight initiative. Appendix V: Technical Requirements Explanation for Enhance Email and Web Security, Binding Operational Directive 18-01 The scope of Binding Operational Directive (BOD) 18-01, Enhance Email and Web Security, includes complex technical concepts that require background knowledge on various topics for both email and web security. The following information provides more detail on the directive’s technical requirements. Email Security When enabled by a receiving mail server, STARTTLS signals to a sending mail server that the capability to encrypt an email in transit is present. While it does not force the use of encryption, enabling STARTTLS makes passive man-in-the-middle attacks more difficult. Email Authentication SPF (Sender Policy Framework) and DKIM (Domain Keys Identified Mail) allow a sending domain to effectively “watermark” its emails, making unauthorized emails (e.g., spam, phishing email) easy to detect. When an email is received that does not pass an agency’s posted SPF/DKIM rules, DMARC (Domain-based Message Authentication, Reporting & Conformance) tells a recipient what the domain owner would like done with the message. Setting a DMARC policy of “reject” provides the strongest protection against spoofed email, ensuring that unauthenticated messages are rejected at the mail server, even before delivery. Additionally, DMARC reports provide a mechanism for an agency to be made aware of the source of an apparent forgery, information that they would not normally receive otherwise. Multiple recipients can be defined for the receipt of DMARC reports. Web Security Hypertext Transfer Protocol (HTTP) connections can be easily monitored, modified, and impersonated; Hypertext Transfer Protocol Secure (HTTPS) remedies these vulnerabilities. HTTP Strict Transport Security (HSTS) ensures that browsers always use an https:// connection, and removes the ability for users to click through certificate- related warnings. In 2015, OMB M-15-13, Policy to Require Secure Connections Across Federal Websites and Web Services, required all existing federal websites and web services to be accessible through a secure connection (HTTPS-only, with HSTS). In 2017, the .gov registry began automatically preloading new federal .gov domains as HSTS-only in modern browsers. Protocols SSL (secure sockets layer) is a computing protocol that ensures the security of data sent via the internet by using encryption. SSLv2 was released in 1995. Most modern clients do not support SSLv2, but a cross- protocol security bug (DROWN) demonstrated that merely serving SSLv2 enables the inspection of traffic encrypted with the more modern and secure protocol, transport layer security. SSLv3 was released in 1996 and considered to be insecure after a man- in-the-middle exploit (POODLE) was published in 2014. Ciphers RC4 (Rivest Cipher 4) is a stream cipher algorithm that is used in popular protocols such as SSL (to protect internet traffic) and wired equivalent privacy (WEP) to secure wireless networks. In 2014, NIST marked RC4 as “not approved” for use in federal information systems. 3DES (3 key triple data encryption standard) is an implementation of the data encryption standard (DES) algorithm that uses three passes of the DES algorithm instead of one as used in ordinary DES applications. Triple DES provides much stronger encryption than ordinary DES, but it is less secure than advanced encryption standard. In 2017, NIST urged all users of 3DES to migrate as soon as possible. Appendix VI: Comments from the Department of Homeland Security Appendix VII: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Neelaxi Lakhmani (assistant director), Kathleen S. Epperson (analyst-in-charge), Season Burris, Christopher Businsky, Noah Levesque, David Matcham, T. Bruce Rackliff, Karl Seifert, and Priscilla Smith made key contributions to the report.