Background Federal agencies are dependent on information technology (IT) systems and electronic data to carry out operations and to process, maintain, and report essential information. These systems are highly complex and dynamic, technologically diverse, and often geographically dispersed. However, the IT systems supporting federal agencies and our nation’s critical infrastructures are at risk. Information and systems are subject to serious threats that can have adverse impacts on organizational operations and assets, individuals, other organizations, and the nation. These threats can include purposeful attacks, environmental disruptions, and human/machine errors, and may result in harm to the national and economic security interests of the United States. In recognition of the growing threat, we designated information security as a government-wide high-risk area since 1997. In 2003, we expanded the information security high-risk area to include the protection of critical cyber infrastructure. We further expanded the information security high- risk area in 2015 to include protecting the privacy of personally identifiable information. Cybersecurity incidents continue to impact federal agencies, as well as entities across various critical infrastructure sectors. In fiscal year 2017, federal executive branch civilian agencies reported 35,277 incidents to the U.S. Computer Emergency Readiness Team. These incidents included web-based attacks, phishing, and the loss or theft of computing equipment. These incidents and others like them can pose a serious challenge to economic and national security and personal privacy. The following examples highlight the impact of such incidents: In January 2019, the Department of Justice (Justice) announced that it had indicted two Ukrainian men for their roles in a large-scale, international conspiracy to hack into the Securities and Exchange Commission’s computer systems and profit by trading on critical information they stole. The indictment alleges that the two hacked into the Commission’s Electronic Data Gathering, Analysis, and Retrieval system and stole thousands of files, including annual and quarterly earnings reports containing confidential, non-public, financial information, which publicly traded companies are required to disclose to the Commission. In March 2018, a joint alert from DHS and the Federal Bureau of Investigation stated that Russian government actors had been targeting the systems of multiple U.S. government entities and critical infrastructure sectors since at least March 2016. These Russian government actors had affected multiple organizations in various sectors, to include energy, nuclear, water, aviation, construction, and critical manufacturing. DHS and the Federal Bureau of Investigation characterized this activity as a multi-stage intrusion campaign by Russian government cyber actors who targeted small commercial facilities’ networks where they staged malware, conducted spear phishing, and gained remote access into energy sector networks. In June 2015, the Office of Personnel Management (OPM) reported that an intrusion into its systems had affected the personnel records of about 4.2 million current and former federal employees. Then, in July 2015, the agency reported that a separate, but related, incident had compromised its systems and the files related to background investigations for 21.5 million individuals. In total, OPM estimated 22.1 million individuals had some form of personally identifiable information stolen, with 3.6 million being a victim of both breaches. The risks to IT systems supporting the federal government and the nation’s critical infrastructure are increasing as security threats continue to evolve and become more sophisticated. These risks include insider threats from witting or unwitting employees, escalating and emerging threats from around the globe, steady advances in the sophistication of attack technology, and the emergence of new and more destructive attacks. Therefore, it is imperative for agency leaders and managers at all levels to manage the risks associated with the operation and use of information systems that support their missions and business functions. Cybersecurity risk management comprises a full range of activities undertaken to protect IT and data from unauthorized access and other cyber threats; maintain awareness of cyber threats; detect anomalies and incidents adversely affecting IT and data; and mitigate the impact of, respond to, and recover from incidents. Information sharing facilitates and supports all of these activities. Federal Law and Policy Set Roles and Responsibilities for Protecting Federal Systems and Managing Cybersecurity Risk Several federal laws, executive orders, and policies establish requirements for protecting federal systems and managing cybersecurity risks. Specifically, FISMA is intended to provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets, as well as the effective oversight of information security risks. The act requires each agency to develop, document, and implement an agency- wide information security program to provide risk-based protections for the information and information systems that support the operations and assets of the agency, including those provided or managed by another entity. FISMA also assigns government-wide responsibilities to key agencies: OMB is responsible for developing and overseeing implementation of policies, principles, standards, and guidelines on information security in federal agencies, except with regard to national security systems. DHS is responsible for certain operational aspects of agencies’ information security policies and practices, including assisting OMB in fulfilling its FISMA authorities, issuing binding operational directives, monitoring agencies’ security policies and practices, and assisting them with implementation. NIST is responsible for developing standards for categorizing information and information systems, security requirements for information and systems, and guidelines for detection and handling of security incidents. More recently, the administration has re-emphasized the importance of improving agencies’ cybersecurity risk management capabilities through the issuance of an executive order. Further, OMB has issued minimum requirements, standards, and guidance to ensure federal managers are effectively managing cybersecurity risks. OMB has also issued policies for enterprise risk management (ERM), which considers all key risks that agencies face and their potential impacts on the agency’s mission. Cybersecurity risk is just one type of risk that agencies consider in their enterprise approach to risk management. Table 1 identifies the administration’s May 2017 executive order and relevant OMB publications and guidance on cybersecurity risk management. In its responsibility for certain operational aspects of agencies’ implementation of cybersecurity practices, DHS is spearheading several initiatives to assist federal agencies in protecting their computer networks and electronic information. Examples of DHS’s initiatives are described in table 2. NIST Has Established a Framework for Federal Cybersecurity Risk Management Activities Implementing effective cybersecurity requires any organization—whether a private sector company; a non-profit entity; or an agency at the state, local, or federal level—to identify, prioritize, and manage cyber risks across its enterprise. Risk management is a comprehensive process that requires organizations to (1) frame risk (i.e., establish the context for risk- based decisions), (2) assess risk, (3) respond to risk once determined, and (4) monitor risk on an ongoing basis using effective organizational communications and a feedback loop for continuous improvement in the risk-related activities of organizations. In accordance with its responsibilities under FISMA, as well as other laws and executive orders, NIST has developed a framework for managing risk to federal information and information assets. This framework calls for a multi-tiered approach to risk management, with activities at the information system (system), business/mission, and organization (e.g., agency) level. Cybersecurity risk management activities at the organization level provide the foundation for activities at the mission/business process and system levels, such as the selection and implementation of security controls and decisions about the operation of systems based on a determination of risk. Figure 1 illustrates an organization-wide approach to cybersecurity risk management. Guidance for federal agencies’ cybersecurity risk management processes is found in a suite of NIST special publications. Table 3 highlights key NIST cybersecurity risk management publications. Federal Guidance Includes Key Steps for Establishing Cybersecurity Risk Management Programs OMB and NIST guidance identify practices for establishing agency-wide cybersecurity risk management programs. Among other things, these activities are intended to facilitate better communication between senior leaders and executives and system owners and operators; align agency priorities with resource allocation and prioritization at the system level; and convey acceptable limits regarding the selection and implementation of controls within the established organizational risk tolerance. Practices that provide a foundation for an agency’s cybersecurity risk management program are summarized in table 4. Establish the role of a cybersecurity risk executive: In order to ensure that cybersecurity risks are being addressed across the agency, NIST Special Publication 800-39 states that agencies should establish a cybersecurity risk executive. This can take the form of an individual or group that provides agency-wide oversight of cybersecurity risk activities and facilitates collaboration among stakeholders and consistent application of the cybersecurity risk management strategy. The cybersecurity risk executive should ensure that risk-related considerations for information systems are viewed from an agency-wide perspective regarding the strategic goals and objectives. The cybersecurity risk executive also should ensure that cybersecurity risk is managed consistently across the agency, reflects organizational risk tolerance, and is considered along with other types of risk to ensure mission/business success. Develop a cybersecurity risk management strategy: According to NIST Special Publication 800-39 and other guidance, agencies should develop a cybersecurity risk management strategy to provide a foundation for managing risk and delineate the boundaries for risk-based decisions. The strategy should describe the strategic-level decisions and considerations that senior leaders and executives are to use to manage security and privacy risks to agency operations, assets, individuals, other organizations, and the nation. The strategy should also guide and inform how security and privacy risks are framed, assessed, responded to, and monitored. The strategy should include (1) a statement of the agency’s risk tolerance, (2) how it intends to assess risk (e.g., acceptable risk assessment methodologies), (3) acceptable risk response strategies (e.g., acceptance, mitigation, avoidance), and (4) how the agency intends to monitor risk over time. Document risk-based policies: NIST Special Publication 800-37 identifies foundational activities at the agency and information system levels that should be included in policies to help prepare agencies to manage security and privacy risks. These activities should be guided by risk-based decisions. Specific elements of such risk-based policies include (1) identifying and assigning individuals with key roles for executing the risk management framework; (2) requiring an agency-wide assessment of cyber risks; (3) identifying and documenting common security controls that can be inherited by multiple information systems; (4) developing an agency-wide strategy for monitoring control effectiveness; (5) requiring system-level risk assessments to be performed and regularly updated; (6) tailoring system security controls based on risk; (7) prioritizing remedial actions to correct vulnerabilities identified in plans of action and milestones (POA&M) based on risk; and (8) using a determination of risk to make decisions about system operation and use. Conduct an agency-wide cybersecurity risk assessment: According to NIST Special Publications 800-39 and 800-37, agencies should assess cybersecurity and privacy risks and update the results on an ongoing basis. Risk assessment at the agency level is based primarily on aggregated information from system-level risk assessment results, continuous monitoring, and any relevant strategic risk considerations. The assessment is intended to help the agency consider the totality of risk derived from the operation and use of its information systems and from information exchanges and connections with other internally and externally owned systems. Such assessments may identify systemic weaknesses or deficiencies discovered in multiple information systems and assess the overall risks that these present to operations, assets, and individuals. Establish coordination between cybersecurity and enterprise risk management: ERM, as a discipline, deals with identifying, assessing, and managing risks. OMB has stated that an effective enterprise risk management program should promote a common understanding for recognizing and describing potential risks that can impact an agency’s mission and the delivery of services to the public. Such risks include strategic, market, cyber, legal, reputational, political, and a broad range of operational risks. Toward this end, OMB Circular A-123 directs agencies to implement a capability for enterprise risk management. Specifically, it encourages agencies to establish a risk management governance structure, such as a risk management council, which may be integrated with existing management structures; develop “risk profiles” that identify risks arising from mission and mission-support operations; and consider those risks as part of the annual strategic review process. Because cybersecurity is a key risk facing virtually every federal agency, it is important for coordination to exist between agencies’ ERM functions and their cybersecurity risk management programs, particularly the cybersecurity risk executive. NIST SP 800-39 states that effective risk management requires an agency’s mission/business processes to explicitly account for information security risk when making operational decisions and that cybersecurity risk information should be shared with key stakeholders throughout the organization. According to NIST, the risk executive should serve as a common risk management resource for senior leaders, mission/business owners, and other organization officials and as a focal point for communicating and sharing information security risk-related information among key stakeholders. OMB has also raised concerns that agencies’ ERM programs do not effectively identify, assess, and prioritize actions to mitigate cybersecurity risks in the context of other enterprise risks. GAO has also emphasized the importance of sharing risk information with stakeholders as part of an effective risk management program. Agencies Have Not Fully Established Elements of Their Cybersecurity Risk Management Programs The 23 civilian CFO Act agencies varied in the extent to which they had established key elements of their cybersecurity risk management programs. Specifically, 22 of the 23 agencies established the role of cybersecurity risk executive, and most of the 23 agencies had established policies that include elements to ensure their activities are guided by risk- based decisions. However, fewer than half of the agencies developed an agency-wide cybersecurity risk management strategy or fully established coordination with their enterprise risk management function. Figure 2 summarizes the extent to which the agencies had established these elements as of April 2019. Most Agencies Established the Role of Cybersecurity Risk Executive Twenty-two of the 23 civilian CFO Act agencies established a cybersecurity risk executive to provide agency-wide oversight of cybersecurity risk activities. Agencies varied in assigning this responsibility to the chief information officer (CIO), chief information security officer (CISO), or another official or entity. For example: At the Department of Health and Human Services (HHS), the CIO serves as the risk executive for the department, and is responsible for executing the Risk Management Framework tasks outlined in NIST SP 800-37. The United States Agency for International Development (USAID) designated the CISO with responsibility for carrying out the risk executive functions for the agency. Among other things, the CISO is responsible for developing, implementing, and managing an agency- wide security authorization process and a threat awareness program. The Department of the Treasury (Treasury) assigned the function of risk executive to its department CIO Council. The council’s responsibilities include ensuring the cybersecurity program is consistent with the provisions of NIST SP 800-39; providing guidance to and oversight of the organization’s risk management program and developing the cybersecurity risk management strategy; communicating organization-wide threat, vulnerability, and risk-related information; and providing a strategic view for managing cyber risk throughout the organization. One agency, the General Services Administration (GSA), had not defined the role of its cybersecurity risk executive in its policy. Officials in GSA’s Office of the CIO stated that they had not formally designated this role because the agency’s risk executive responsibilities were shared among the CIO, CISO, authorizing officials, and other GSA officials for risk management. However, without clearly defining and documenting the responsibility for the risk executive function, the agency may lack consistent implementation and oversight of cybersecurity risk management activities and an effective agency-wide view for managing risk. Additional details on the 23 agencies’ cyber risk executive positions are provided in appendix II. Most Agencies Did Not Develop an Agency-Wide Cybersecurity Risk Management Strategy to Guide Their Risk Decisions Among the 23 civilian CFO Act agencies, seven had developed a cybersecurity risk management strategy that fully addressed the four elements called for in the NIST guidance. Specifically, each of the seven agencies (the Department of Commerce (Commerce), the Department of Labor (Labor), the Department of State (State), USAID, GSA, OPM, and the Social Security Administration (SSA)) had developed a strategy to guide how cybersecurity risk is to be framed, assessed, responded to, and monitored. For example, some of the strategies discussed risk tolerance in terms of thresholds based on essential mission functions and the processing of personally identifiable information or system impact levels, types of data processed, and accessibility of systems, among other factors. The strategies also included breakdowns of appropriate risk response strategies and how the agencies intended to assess and monitor risk. In addition, five of the 23 agencies (the Department of Education (Education), Environmental Protection Agency (EPA), National Science Foundation (NSF), the Department of Transportation (Transportation), and the Small Business Administration (SBA)) had partially developed cybersecurity risk management strategies, but their strategies did not address certain required elements. Specifically, while these agencies developed strategic documents, these documents did not include all of the required elements, such as a statement of risk tolerance or acceptable risk mitigation strategies. EPA officials stated that they intended to update their strategy documents to address how the agency intends to assess risk, while Education and NSF officials did not state whether they intended to update their strategy to include a statement of risk tolerance, among other missing elements. Transportation and SBA officials stated that they believed their existing strategy documents addressed all the elements; however, neither agency’s strategy included an expression of departmental risk tolerance and risk mitigation strategies. Further, Transportation’s strategy did not include a description of acceptable risk assessment methodologies. The remaining 11 agencies had not developed an agency-wide cybersecurity risk management strategy. These agencies offered a variety of reasons for not doing so. Seven agencies—the Department of Agriculture (Agriculture), Department of Energy (Energy), HHS, Department of the Interior (Interior), Treasury, the National Aeronautics and Space Administration (NASA), and the Nuclear Regulatory Commission (NRC)—acknowledged that they had not developed a cybersecurity risk management strategy that includes the key elements. According to agency officials, this was due to the federated nature of the agency or difficulty in establishing an agency-wide understanding of risk tolerance, among other factors. Further, these agencies stated that they intended to develop such a strategy or were considering doing so. The other four agencies—DHS, the Department of Housing and Urban Development (HUD), Department of Justice (Justice), and Department of Veterans Affairs (VA)—stated that they believed their existing documents and policies constituted a risk management strategy. However, we determined that these documents did not constitute an integrated strategy that addressed key elements such as risk tolerance and risk mitigation strategies. Without a comprehensive risk management strategy, the agencies may lack an organization-wide understanding of acceptable risk levels and appropriate risk response strategies to protect their systems and data. Additional details regarding the 23 agencies’ establishment of cybersecurity risk management strategies are discussed in appendix III. Agencies Established Policies for Implementing Risk Management Activities, but Gaps Remain in Some Areas Most of the 23 agencies had established policies that include elements to ensure their activities are guided by risk-based decisions. However, many agencies had gaps in one or more of these areas. Specifically, six agencies (DHS, Education, Justice, Treasury, NSF, and SSA) addressed all of these areas in their policies and procedures, while the remaining 17 agencies had not addressed at least one area. Table 5 discusses, for each of these elements, which of the 23 agencies had addressed it in their policies. Eleven agencies—Agriculture, Commerce, Energy, HHS, Interior, Labor, EPA, GSA, NASA, NRC, and OPM—generally agreed that their policies lacked identified elements and either stated that they intended to update policies to include them or would consider doing so. The remaining six agencies—HUD, State, Transportation, VA, USAID, and SBA—stated that they believed their policies addressed these elements or that they carried out these activities in practice, but did not provide documentation of policies that addressed them. Without ensuring that their policies include all key risk management activities, the agencies may not be taking the foundational steps needed to effectively identify and prioritize activities to mitigate cybersecurity risks that could result in the loss of sensitive data or compromise of agency systems. Additional details on the agencies’ risk management policies are provided in appendix IV. About Half of the Agencies Developed an Agency- Wide Cybersecurity Risk Assessment Process Twelve of the 23 civilian CFO Act agencies had developed a process or mechanism for conducting an agency-wide cybersecurity risk assessment. Specifically, these agencies (Agriculture, Education, Energy, DHS, HUD, Interior, Justice, Labor, State, Transportation, NSF, and SSA) had developed processes for aggregating system-level data and analyzing them to assess overall cybersecurity risk to agency operations and assets. For example, these 12 agencies developed scorecards or dashboards that provided agency-wide views of key indicators aggregated from system-level information and risk scores for agency components. Officials from seven of these agencies described how these assessments enable them to make enterprise-wide decisions on prioritizing and remediating risks. The remaining 11 agencies (Commerce, GSA, HHS, NASA, NRC, Treasury, VA, EPA, OPM, SBA, and USAID) offered a variety of reasons for why they did not develop a process for assessing cybersecurity risks at the agency level. Five agencies stated that they were still working to develop or acquire tools that will allow them to aggregate system-level data, and three of these noted that they expected further implementation of DHS’s CDM initiative to provide this capability. The other six agencies stated that they did conduct such an assessment in practice, but did not provide sufficient documentation of the process they use. Without a means of aggregating and assessing cybersecurity risks arising from their information systems to the organizational level, these 11 agencies may be missing opportunities to identify trends or prioritize investments in cybersecurity risk mitigation activities in order to target widespread or systemic risks to the systems and organization. Additional details of agencies’ processes for conducting organization-wide cyber risk assessments are contained in appendix V. Most Agencies Did Not Fully Establish Their Approach to Coordinating between Cybersecurity and Enterprise Risk Management Ten of the 23 civilian CFO Act agencies provided evidence of having a fully established process for coordination between their cybersecurity risk executive and the entity responsible for overall ERM functions. Five agencies provided evidence of a partially established process, and eight could not provide evidence of such a process. The ten agencies with fully established processes included this coordination as part of their defined and documented ERM governance structure and process. The agencies took steps to ensure such coordination in a variety of ways. For example, eight agencies, including Education and USAID, established a specific body, such as a risk management council, with responsibility for ERM. These agencies included their cybersecurity risk executive in the council’s membership in order to facilitate coordination. Other agencies, such as the National Science Foundation, ensured coordination through regular reporting or briefings between their cybersecurity risk executive and their ERM governance structure. In addition, five agencies partially established an approach to coordination in this area. These agencies provided some evidence of coordination activities, but had not formally defined or documented this coordination as part of their ERM structure or process. Specifically, four of these agencies (Justice, the Department of Transportation (Transportation), the Environmental Protection Agency (EPA), and the Social Security Administration (SSA)), provided evidence of occasional coordination between their cybersecurity risk executive and officials responsible for ERM. However, they did not fully define and document their ERM governance structures and processes, including how coordination with the cybersecurity risk executive was to take place. One agency—GSA—had not formally documented the position or responsibilities of the cybersecurity risk executive in its policy. Thus, the agency could not show that the risk executive was involved in ERM activities, although the agency board responsible for ERM does include the agency CIO as a co-chair. Although they did not provide evidence of a fully documented process, officials from these five agencies stated that they perform this coordination in practice. However, documenting these processes would help ensure a consistent, rather than ad-hoc, approach to communication and coordination. Lastly, eight agencies had not established an approach to coordination in this area. In particular, these agencies (Agriculture, HHS, Interior, VA, DHS, State, Treasury, and NRC) either did not have an ERM governance structure and/or did not provide evidence of a process for coordination between their ERM governance structure and their cybersecurity risk executive. Officials from two of these agencies stated that they were still in the process of formalizing their approach to ERM, while the other six stated that such coordination occurs, even if processes may not be fully documented. However, as noted previously, documenting these processes would help ensure a consistent, rather than ad-hoc, approach to communication and coordination. Without regular coordination between the cybersecurity risk executive and broader ERM entity, senior leadership responsible for ERM may not be fully aware of significant cybersecurity risks and, thus, may not be positioned to address them in the context of other risks and their potential impacts on the mission of the agency. Additional details on agencies’ coordination processes are provided in appendix VI. Agencies Identified a Variety of Challenges in Developing and Implementing Cybersecurity Risk Management Programs Officials responsible for cybersecurity risk management at a majority of the 23 civilian CFO Act agencies reported eight challenges in establishing and implementing cybersecurity risk management programs. Most commonly cited were challenges related to hiring and retaining qualified personnel, competing priorities between cybersecurity and agency mission or operations, and establishing and implementing consistent cybersecurity risk management policies and procedures. Figure 3 shows the challenges identified and the number of agencies reporting each challenge. Hiring and Retaining Key Cybersecurity Risk Management Personnel All of the 23 civilian CFO Act agencies reported hiring and retaining personnel to fill key cybersecurity risk management positions as a challenge in establishing a cybersecurity risk management program. In particular, six agencies cited the lengthy federal hiring process, and 14 noted the difficulty in competing with private-sector companies in salary and other benefits. Further, 11 agencies noted that there is a shortfall in candidates with the skills needed for cybersecurity risk management. For example: NASA’s Chief Cyber Risk Officer noted that cybersecurity risk management is a multi-disciplinary field that blends technical cyber expertise with project management principles and a business-focused management background. This official stated that it is difficult to find talent that possesses this multi-disciplinary experience, in part, because current government marketing for cybersecurity skill sets advertise for purely technical skills. The official added that, currently, the government lacks clearly defined roles for cyber risk management as a dedicated job function. HUD’s CIO saw this challenge as part of a larger shortfall of this highly in-demand resource and noted that HUD must compete with tech giants and Silicon Valley startups for qualified personnel. The official stated that the executive order providing direct hiring authorities for cybersecurity positions provides assistance, though the department still needs to be creative in enhancing retention and recruitment efforts through bonuses and other incentives. A key to having a successful cybersecurity program is having a well- trained, highly qualified workforce that is versed in identifying cyber threats and recognizes steps to take once confronted with them. Our work has identified difficulties in recruiting and retaining qualified cybersecurity professionals as a continuing challenge. If agencies are unable to hire and retain qualified cybersecurity risk management personnel, they will be hindered in establishing effective programs for cybersecurity risk management. Managing Competing Priorities between Operations and Cybersecurity Nineteen of the 23 civilian CFO Act agencies reported competing priorities between agency mission operations and cybersecurity as a challenge. In particular, 12 agencies noted that cybersecurity requirements are sometimes perceived as impeding mission activities, such as deploying systems, sharing information, or providing public services. In addition, four agencies highlighted the competition for limited resources between cybersecurity risk management activities and operational or mission needs. For example: HHS’s Acting Deputy CISO stated that, due to the federated nature of the agency and the broad spectrum of its missions and business functions, there is often a disconnect between security and operational personnel. As an example, the official stated that Operating Divisions that are research or academics focused will require increased information sharing and flexibility, but this often conflicts with cybersecurity concepts and processes. Interior’s Deputy CIO stated that the need to balance mission priorities with those related to cybersecurity risk management leads to fiscal and operational challenges when making investment, architectural, and operational decisions. NIST emphasizes determining the relative importance of the mission/business functions in order to make the appropriate level of risk management investment. If agencies are unable to establish priorities among cybersecurity and operational needs, they may be challenged in allocating resources appropriately to ensure their systems and information are appropriately secured. Establishing and Implementing Consistent Cybersecurity Risk Management Policies and Procedures Eighteen of the 23 civilian CFO Act agencies reported challenges in establishing and implementing consistent cybersecurity risk management policies and procedures across the organization. Eight agencies cited challenges in this area arising from the difficulty in ensuring consistency across a federated or decentralized organization, while other factors included training staff and making them aware of policies, and the need to integrate cybersecurity policies with missions and operations. For example: EPA’s CISO related that challenges in consistent implementation of policies and procedures include the need to train individuals involved in the risk management process, address different views of risk appetite within the agency, and deal with varying perspectives on the importance of cybersecurity, among other things. OPM’s Deputy CISO highlighted that frequent changes in the agency’s leadership (e.g., having eight CIOs since 2012) had led to challenges with the agency’s ability to implement consistent policies in an ongoing, streamlined manner. As we have previously reported, CIOs and former agency IT executives believed it was necessary for a CIO to stay in office for 3 to 5 years to be effective and 5 to 7 years to fully implement major change initiatives in large public sector organizations. In addition, the Deputy CISO stated that the establishment and implementation of cybersecurity risk management policies and procedures has been viewed as a secondary responsibility, to be accomplished when more pressing and immediate operational concerns do not need attention. NIST has emphasized the importance of a consistent approach in order for cybersecurity risk management to succeed at all levels of an agency. If agencies are unable to establish consistent cybersecurity risk management policies and procedures, they may not be able to effectively prioritize and implement security and privacy activities to protect their most critical assets and systems. Establishing and Implementing Standardized IT Capabilities Eighteen of the 23 civilian CFO Act agencies reported challenges in establishing and implementing standardized IT capabilities across the organization. Eleven of these agencies noted that decentralized or federated organizations create difficulty in implementing standardized, agency-wide tools and solutions to manage cybersecurity risks. In addition, four agencies cited issues with legacy systems, which may not always be compatible with capabilities intended to be used agency wide. For example: The Department of Commerce’s (Commerce) Deputy CISO stated that, because Commerce is a largely federated agency, with each bureau operating and maintaining its own environment, managing a truly enterprise solution is challenging in numerous areas. For example, the official stated that the department cannot control access at bureaus due to disconnected networks, different security offices and policies, and even different logical access policies. The official added that a change in governance and thinking toward common enterprise tools and solutions requires a shift in management and thinking across the department and its bureaus. Energy’s Acting Deputy CIO for Cybersecurity stated that the department is working, to the degree possible, to implement enterprise solutions for cybersecurity and continuous monitoring; however, because the enterprise is comprised of laboratories and sites with very diverse mission sets, doing so is always challenging. This official added that the department has embraced the DHS CDM initiative, which will be leveraged to standardize some IT cybersecurity capabilities, but it does not have a single standardized solution across the enterprise. OMB recently noted that an agency’s ability to mitigate security vulnerabilities becomes more complex in federated agencies, where there are not standardized procedures or technology across the organization. The challenges in implementing standardized IT capabilities may hinder these agencies in applying a consistent level of protection to their systems and data. Receiving Quality Data to Provide Visibility into Risks Eighteen of the 23 civilian CFO Act agencies reported that they had experienced challenges in receiving quality data (e.g., accurate, timely information on threats and vulnerabilities). Twelve of these agencies expressed challenges in receiving data from all parts of their agencies or stated that they relied on manual reporting from their components, which did not provide real-time visibility into risks. In addition, six agencies cited difficulties in combining data from disparate sources into an agency-wide view of risk. For example: DHS’s Acting Director of Governance and Executive Management noted that the department’s management currently depends on its components to submit timely and accurate information on cybersecurity vulnerabilities instead of having real-time, centralized reporting of data. The official added that DHS expects to address this challenge through implementation of CDM centralized reporting to the DHS Dashboard on a near real-time basis and other tools and processes for enterprise data collection. State’s Enterprise Risk Officer for Cybersecurity reported that threat information is difficult to gather with the specificity needed to make strategic decisions. The official added that, with regard to vulnerability data, sufficient data exist and are gathered on a regular basis; however, it is difficult in a large global enterprise to prioritize actions without credible information on the likelihood of a threat or its impact on the agency’s mission. NIST emphasizes that risk monitoring tools, techniques, and procedures can increase risk awareness and help senior leaders develop a better understanding of the ongoing risk to organizational operations and assets. If the agencies are unable to consistently receive quality, timely data from their entire organizations, they will continue to be challenged in making effective decisions to address organization-wide cybersecurity risks. Using NIST and OMB Guidance Sixteen of 23 civilian CFO Act agencies reported the lack of sufficiency, clarity, or usefulness of NIST and/or OMB guidance for cybersecurity risk management as a challenge. Six agencies stated that there was a lack of practical instruction to assist agencies in implementing guidance. Six agencies also stated that various guidance documents are not always consistent or easy to understand. Six agencies also expressed a need for guidance to address new technologies or emerging areas such as the use of cloud providers or establishing cybersecurity risk management programs at all levels of an organization. For example: HHS’s Acting Deputy CISO stated that, for all the positive aspects of the NIST guidance, there is a lack of a centralized document or road map that ties all the documents together from a cybersecurity standpoint. Also, the official stated that the guidance from NIST provides limited direction for producing specific metrics and checklists in support of laws, policies, directives, instructions, and standards. Transportation’s CISO stated that current guidance does not always provide agencies with practical ways to implement requirements. For example, the official noted that current OMB guidance on cyber and privacy risk management does not tell agencies how to practically integrate these disciplines, and that frequent updates to NIST guidance that agencies have to respond to might be better applied to identifying practical implementations. The official added that a lack of practical implementation guidance may lead to duplication of effort and inconsistency of outcomes. OMB and NIST play important roles in issuing policies, standards, and guidelines for agencies’ cybersecurity risk management programs. However, if agencies find guidance unclear or insufficient, they will be challenged in implementing key cybersecurity risk management requirements. Developing a Strategy to Manage Cybersecurity Risks Fifteen of the 23 CFO Act agencies reported challenges in developing an agency-wide cybersecurity risk management strategy that includes a statement of risk tolerance and how the agency will assess, respond to, and monitor risks. Ten agencies stated that they faced challenges in establishing an agency-wide risk tolerance statement, while five noted that they faced challenges in implementing a strategy across the agency. For example: Education’s Audit Liaison Officer from its Office of the CIO noted that it was a challenge to develop an enterprise-level statement of risk tolerance and that currently risk tolerance decisions were made at the system level by the authorizing official. EPA’s CISO reported that it was challenge to establish an agency- wide statement of risk tolerance. This is because it was difficult to determine such factors as how much the mission’s operation is worth, how much information resources are worth, and how much negative public perception of the agency costs in terms of money or resources. NIST notes that framing risk through the creation of a cybersecurity risk management strategy establishes a foundation for managing risk and delineates the boundaries for risk-based decisions within an agency. If agencies are challenged in developing cybersecurity risk management strategies, they may be hindered in making consistent decisions for identifying, assessing, and responding to cybersecurity risks. Incorporating Cyber Risks into Enterprise Risk Management Fourteen of the 23 civilian CFO Act agencies reported that incorporating cyber risks into the enterprise risk management process was a challenge. Nine of these agencies noted challenges related to coordination between cybersecurity and ERM, such as establishing effective channels of communication or developing vocabularies for discussing risk that were understandable by all stakeholders. In addition, five agencies noted that their ERM process was still maturing. For example: GSA’s Associate Chief Information Officer for Enterprise Planning & Governance stated that a process was implemented to assess cyber risks as part of the formalized ERM process; however, this official noted that additional work is still needed to align and incorporate other regular cybersecurity risk management reporting processes and communication channels into the broader ERM framework. Treasury’s Enterprise Cybersecurity Risk Management Officer stated that incorporating cyber risks into ERM is a challenge because cybersecurity risk is not currently quantified in the same way as other risks. The official expressed the need for a standard vocabulary for discussing cyber alongside other risks, adding that this makes it very challenging to integrate cybersecurity risk management into ERM. OMB has stated that an effective enterprise risk management program promotes a common understanding for recognizing and describing potential risks that can impact an agency’s mission and the delivery of services to the public. Such risks include strategic, market, cyber, legal, reputational, political, and a broad range of operational risks. If agencies do not successfully integrate cyber risks into their ERM processes, they may be hindered in making effective decisions about addressing cybersecurity risks in the context of other risks and their potential impact on agency missions. OMB and DHS Took Steps to Improve Cybersecurity Risk Management; Current Initiatives Address Some but Not All Identified Challenges In accordance with a recent executive order, OMB and DHS took steps to assess agencies’ cybersecurity management capabilities. They also identified core actions to be taken, in coordination with agencies, to address cybersecurity risks across the executive branch. Accordingly, OMB and DHS have several initiatives under way to address these risks, and several of these initiatives should help address some of the challenges in establishing cybersecurity risk management programs that the agencies in our review identified. However, these initiatives do not address other challenges identified by a majority of the agencies. OMB and DHS Assessed Government-Wide Cybersecurity Risks and Identified Findings Related to Federal Cybersecurity EO 13800 on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure emphasizes the importance of reducing cybersecurity risks while also providing exceptional service to the public. The EO aligns with FISMA by holding agency heads accountable for managing cybersecurity risks. Toward this end, it directed agency heads to provide a risk management report to OMB and DHS that documented the agency’s risk mitigation and acceptance choices as of May 2017 and describe the agency’s action plan to implement the NIST cybersecurity framework. The EO required OMB and DHS to assess each agency’s risk management report and OMB, in coordination with DHS, to develop and deliver a risk determination report to the President on whether the risk mitigation and acceptance choices set forth in the agencies’ reports were appropriate and sufficient to manage the cybersecurity risk to the executive branch as a whole. OMB’s and DHS’s report was also to include an action plan to, among other things, adequately protect the executive branch, should the risk determination identify insufficiencies in agencies’ risk mitigation and acceptance choices; establish a regular process to reassess and, if appropriate, reissue the determination and address future recurring and unmet budgetary needs necessary to manage risk to the executive branch; and if appropriate, clarify, reconcile, and reissue policies, standards, and guidelines issued in furtherance of FISMA and the EO, and align them with the NIST cybersecurity framework. In May 2017, OMB issued guidance to agencies for implementing the provisions in EO 13800 on managing cybersecurity risks. This guidance required agencies to, among other things, report on their cybersecurity risk management capabilities using the metrics established for monitoring FISMA implementation. OMB and DHS used the results of the agencies’ risk management reports and responses to the FISMA reporting metrics to assess agencies’ capabilities and make risk determinations of agencies’ performance (“high risk,” “at risk,” or “managing risk”). OMB and DHS’s process included an assessment of 96 agencies across the executive branch, including the 23 civilian CFO Act agencies in the scope of our review. In May 2018, OMB published the Federal Cybersecurity Risk Determination Report and Action Plan, in which OMB and DHS determined that 74 percent of the federal agencies participating in the risk assessment process had cybersecurity programs that were either “at risk” or “high risk.” The report identified four key findings and actions necessary to address cybersecurity risks across the federal enterprise, as summarized in table 6. The report also described OMB’s plans to work with DHS and other federal entities to implement these actions and reduce cybersecurity risks across the government. OMB and DHS also established a process for reassessing and, if necessary, reissuing the agency risk determinations. Specifically, OMB and DHS use the metrics collected during the FISMA reporting process to update each agency’s risk management assessment on an ongoing basis. At a minimum, CFO Act agencies must update their metrics quarterly. The quarterly risk management assessment process allows for the monitoring of agency-level risks, and OMB issues guidance yearly codifying this process. In addition, OMB staff stated that they plan to incorporate the overall risk determination into the office’s annual FISMA report to Congress, although they noted that this is subject to change. Further, OMB and DHS took steps to align government-wide cybersecurity guidance with the NIST cybersecurity framework. For example, OMB and DHS, in coordination with the federal cybersecurity community, updated the reporting guidance on CIO and Inspector General FISMA metrics to align with the framework. The FISMA metrics leverage the framework as a standard for managing and reducing cybersecurity risks, and the metrics are aligned with the five main functions of the framework to provide agencies with a comprehensive structure for making more informed, risk-based decisions, managing cybersecurity risks across their enterprise, and providing a view of agencies’ capabilities and potential gaps. OMB and DHS Have Several Initiatives Under Way That Can Help Address Some, but Not All, Agency-Identified Challenges OMB and DHS have several initiatives under way—some of them also outlined in OMB’s federal cybersecurity report—that can assist agencies in meeting challenges related to hiring and retaining cybersecurity risk management personnel, establishing standardized IT capabilities, receiving quality data, and using NIST and OMB guidance. Workforce education initiatives: In November 2018, OMB announced the launch of the Federal Cyber Reskilling Academy pilot program, which is being sponsored by the CIO Council. This program offers current federal employees who do not work in the IT field the opportunity for hands-on training in cybersecurity for 3 months to help them build foundational skills in cyber defense analysis. In addition, the National Initiative for Cybersecurity Careers and Studies is an online resource for cybersecurity training managed by DHS that connects government employees, students, educators, and industry with cybersecurity training providers throughout the nation. The initiative’s Federal Virtual Training Environment, for example, is an on-demand cybersecurity training system that contains more than 800 hours of training on a variety of topics, including risk management. These initiatives, if effectively implemented, could help address challenges agencies identified in hiring and retaining cybersecurity risk management personnel. Specifically, the Cyber Reskilling Academy has the potential to increase the pool of federal employees with skills that agencies need for cyber risk management. In addition, the Federal Virtual Training Environment can enhance federal employees’ knowledge of and skills in cybersecurity risk management. Continuous Diagnostics and Monitoring (CDM): DHS’s CDM initiative is to provide federal agencies with tools and services that have the intended capability to automate network monitoring, correlate and analyze security-related information, and enhance risk- based decision making at agency and government-wide levels. These tools include sensors that perform automated scans or searches for known cyber vulnerabilities, the results of which can feed into a dashboard that, at an agency level, is intended to alert network managers and enable the agency to allocate resources based on the risk. Summary data from each participating agency’s dashboard is expected to be transmitted to the Federal Dashboard, where the data can be used to inform decisions about cybersecurity risks across the federal government. A DHS CDM program official stated that the department plans to continue to deploy capabilities in fiscal year 2019 for asset management, identity and access management, and monitoring network controls and activity. The CDM initiative, if effectively implemented, has the potential to assist in addressing challenges agencies identified in establishing standardized IT capabilities for cybersecurity risk management and improving the quality of data to provide visibility into cyber risks. In particular, the tools and services offered through the program can provide agencies with standardized capabilities for collecting and analyzing cyber risk information. In addition, automated network monitoring and analysis can help agencies that currently must manually collect data from components based on self-reporting. Such data may be less timely and accurate than those collected through the tools available through CDM. Security operations center (SOC) consolidation and maturation: A SOC defends an organization against unauthorized activity within computer networks, including, at a minimum, detecting, monitoring, and analyzing suspicious activity. According to OMB, CISOs report that these centers do not communicate with each other and that they hoard, rather than share, threat information and intelligence. SOC consolidation focuses on centralizing information sharing across the agency, which is intended to improve the data agencies receive to provide visibility into cybersecurity risks. OMB and DHS are working with agencies to assess and enhance the maturity of their SOCs and streamline security operations across their enterprise. Specifically, agencies are required to develop and submit a Cybersecurity operations maturation plan to OMB and DHS by April 2019. Following submission of the plan, agencies are then required to complete SOC maturation, consolidation, or migration to a SOC-as-a-Service provider by September 2020. Similar to CDM, SOC consolidation and maturation initiatives may help address challenges related to standardizing capabilities and collecting quality data, while enhancing enterprise-wide visibility. Consolidation can provide agencies with a standardized set of SOC services, while maturation can increase the quality of data on risks by establishing a baseline set of expected SOC capabilities for executive branch agencies. Cyber threat framework: OMB and DHS are developing and disseminating a framework, working with the Department of Defense, Office of the Director of National Intelligence, and the National Security Agency, to enable consistent characterization and categorization of cyber threat events. Specifically, the Cyber Threat Framework provides a hierarchical, structured, transparent, and repeatable methodology for characterizing adversarial activities in a standardized way across the federal government. The framework and the related methodology provide for a cybersecurity architecture review that allows an agency to assess its cyber capabilities against its actual threat environment. This includes a gap analysis to determine where agencies may need to enhance their capabilities to defend against key threats. To foster the adoption of the Cyber Threat Framework across the government, DHS—in coordination with OMB and the Department of Defense—intends to develop and implement a solution that will be available for agencies to use by the end of December 2019. The Cyber Threat Framework, if effectively implemented by civilian federal agencies, can also help address agency challenges related to the quality of data about cyber risks. By providing a standardized framework for understanding cyber threats, it is intended to assist agencies to better identify and prioritize risks, as well as the gaps in their capabilities for protecting against such threats. Inter-agency cyber-focused working groups: In coordination with DHS, OMB established CyberStat review sessions to assist agencies in protecting their systems, networks, and data. Specifically, agency cyber professionals, from the working level to the CIO, meet with DHS subject matter experts to participate in working sessions throughout a 4- to 6-week period to overcome barriers to success in specific cybersecurity programs. During a CyberStat review, DHS provides agencies with guidance on best practices and connects them with other subject matter experts who can provide advice on implementing the NIST framework and cybersecurity risk management practices. In addition, the federal CIO Council has recently issued the CISO Handbook, which was created to educate and inform new and existing CISOs about their role in federal cybersecurity. The council is the principal interagency forum for improving agency practices related to the use, sharing, and performance of federal information resources and part of its governing principles are to adopt and share IT management best practices and to manage risk and ensure privacy and security. Within the CIO Council, the CISO Council is specifically tasked with developing IT security policy and sharing best practices to improve the cybersecurity posture of the United States. Among other things, the CISO Handbook includes information on NIST’s cybersecurity framework and how it can be leveraged in conjunction with other NIST risk management publications. CyberStat reviews and the federal CIO Council can provide channels to help agencies in better understanding and implementing guidance from NIST and OMB on cybersecurity risk management. By connecting agencies with best practices and subject matter experts, CyberStat sessions are intended to help agencies, for example, apply the NIST framework and cyber risk management practices. In addition, the CIO Council, through sharing of best practices and issuing publications, can provide guidance on how to more effectively implement federal cybersecurity risk management guidance. Although the initiatives under way could address challenges related to hiring and retaining cybersecurity risk management personnel, developing standardized capabilities, acquiring quality data about cyber risks, and using NIST and OMB guidance, the existing initiatives do not address challenges related to managing competing priorities, establishing consistent policies and procedures, incorporating cyber risks into enterprise risk management, and developing an agency-wide strategy for managing cybersecurity risks. Managing competing priorities between cybersecurity and operations: OMB staff stated that its newly developed risk-based budgeting model could help agencies prioritize their cybersecurity investments. This model is intended to tie agencies’ cybersecurity spending to the FISMA metrics process in order to identify capability and process gaps that pose risks to an agency. OMB plans to disseminate the risk-based budgeting process to enable agency CIOs, CISOs, and Chief Financial Officers to communicate cyber risks effectively across their agencies and to budget strategically for cyber capabilities that address the agency’s most critical cybersecurity needs. OMB anticipates being able to provide agencies with additional details surrounding this model in the cybersecurity section of its upcoming fiscal year 2020 guidance to the President’s budget. However, while this risk-based approach to cybersecurity budgeting should help agencies prioritize their cybersecurity investments, it does not address issues related to prioritizing between cybersecurity and mission or operational needs. The agencies in our review highlighted that mission or operational priorities can conflict with cybersecurity requirements when, for example, components within an agency have differing views about the relative importance of mission and cybersecurity activities. These issues do not relate to prioritizing investments in cybersecurity but to managing conflicts, or potential conflicts, between cybersecurity and mission needs. Implementing consistent cybersecurity risk management policies and procedures: OMB staff stated that several of OMB’s and DHS’s initiatives emphasize driving performance through centralized visibility, authority, and reporting. For example, OMB staff stated CDM is intended to establish agencies’ visibility across the enterprise, as well as government-wide visibility. OMB staff stated the implementation of provisions commonly referred to as the Federal Information Technology Acquisition Reform Act is intended to enhance the role and authority of agency CIOs, particularly with respect to relationships with agency components and accountability for IT costs, performance, and security. Additionally, OMB staff stated the risk management assessment process established in response to EO 13800 emphasizes centralized visibility, authority, and reporting. While these efforts could provide increased visibility and CIO authority, they do not address factors identified by agencies that affected their ability to implement consistent cybersecurity risk management policies and procedures. These include differing views among staff regarding the importance of risks, and frequent changes in leadership, all of which, according to agencies, make consistency difficult to achieve. Incorporating cyber risks into ERM: While existing OMB guidance requires agencies to establish ERM programs and NIST guidance requires agencies to establish cybersecurity risk management programs, this guidance does not address how these efforts should be integrated or coordinated. For example, OMB A-123 outlines agencies’ responsibilities for establishing an ERM capability but does not specifically address how enterprise risk management should incorporate cyber risks. In addition, NIST guidance on cybersecurity risk management recognizes that cybersecurity can be an important component of an organization’s overall risk management and states that its information security risk management guidance should be used as part of a more comprehensive ERM program. However, it does not explicitly discuss how to integrate or coordinate cybersecurity risk management and enterprise risk management. Establishing a cybersecurity risk management strategy: OMB noted that the cyber threat framework will provide a more tangible way for agencies to identify and prioritize cyber risks. However, while this framework will allow agencies to better identify and categorize threats and the capabilities needed to counter them, it does not address key aspects of risk framing such as establishing an agency-wide statement of risk tolerance and acceptable risk mitigation strategies. Several agencies noted that they struggled to define risk tolerance and establish criteria for different risk responses that could provide a consistent, agency-wide approach to risk management. Without additional guidance or other processes to identify successful approaches for addressing these challenges, agencies will continue to be hindered in establishing programs for effectively managing their cybersecurity risks. Conclusions Given the increasing number and sophistication of cyber threats facing federal agencies, it is critical that agencies are well positioned to make consistent, informed risk-based decisions in protecting their systems and information against these threats. While all the agencies in our review have taken steps to establish cybersecurity risk management programs, they have not fully addressed key practices that are foundational to effectively managing cybersecurity risks. In particular, without developing an agency-wide cybersecurity risk management strategy, agencies may lack a consistent approach to managing cybersecurity risks. In addition, while agencies have documented policies and procedures that include many key practices, gaps remain that may hinder their ability to ensure a consistent implementation of risk-based practices. Further, without a process for an agency-wide cybersecurity risk assessment, agencies may be missing opportunities to identify risks that affect their entire organization, and to implement solutions to address them. Finally, establishing processes for coordinating cybersecurity risk information with the entity responsible for enterprise risk management would help ensure that cyber risks are being considered by senior leadership in the context of other risks facing the agency. This inconsistent establishment of cybersecurity risk management practices can be partially attributed to challenges agencies identified in establishing and implementing their cybersecurity risk management programs. Specifically, agencies noted a variety of challenges such as hiring qualified staff, competing priorities between cybersecurity and mission needs, implementing consistent policies and procedures, incorporating cyber risks into enterprise risk management processes, and developing a cybersecurity risk management strategy. Addressing these challenges will be an important step toward establishing more effective cybersecurity risk management programs across the 23 agencies. OMB and DHS have taken steps to carry out their responsibilities to identify and address weaknesses across the executive branch, including actions that would address many of the challenges identified by agencies. However, without fully addressing challenges related to prioritization between cybersecurity needs and mission priorities, implementing consistent risk management policies and procedures, incorporating cyber risks into enterprise risk management, and establishing a cybersecurity risk management strategy, OMB and DHS are likely to be missing opportunities to assist agencies in these key areas. Clarified or updated guidance, along with sharing successful practices or lessons learned, could help agencies more fully establish their cybersecurity risk management capacity. Recommendations for Executive Action We are making the following recommendation to OMB: The Director of OMB should, in coordination with the Secretary of Homeland Security, establish guidance or other means to facilitate the sharing of successful approaches for agencies to address challenges in the areas of (1) managing competing priorities between cybersecurity and operations, such as when operational needs appear to conflict with cybersecurity requirements; (2) implementing consistent cybersecurity risk management policies and procedures across an agency; (3) incorporating cyber risks into enterprise risk management, and (4) establishing agencies’ cybersecurity risk management strategies. (Recommendation 1) We are also making a total of 57 recommendations to the 23 civilian CFO Act agencies in our review to fully address key practices in their cybersecurity risk management policies and procedures. Appendix VII contains these recommendations. Agency Comments and Our Evaluation We requested comments on a draft of this report from OMB and the 23 civilian CFO Act agencies included in our review. All the agencies provided responses, as further discussed. In an email from the office’s GAO audit liaison on July 8, 2019, OMB did not state whether it agreed or disagreed with our recommendations. However, the office provided technical comments, which we incorporated as appropriate. Of the 23 civilian CFO Act agencies, 17 agencies (Education, Energy, DHS, HUD, Interior, Labor, State, Transportation, VA, USAID, GSA, NASA, NSF, NRC, OPM, SBA, and SSA) concurred with our recommendations; one agency (HHS) partially concurred with our recommendations; three agencies (Commerce, Justice, and Treasury) provided comments but did not state whether they agreed or disagreed with our recommendations; and two agencies (Agriculture and EPA) stated that they had no comments on the report. Multiple agencies also provided technical comments, which we incorporated as appropriate. The following 17 agencies concurred with our recommendations and, in most cases, described steps planned or under way to address them: The Department of Education provided written comments in which it concurred with our recommendation and stated that the department will continue its efforts to fully develop a cybersecurity risk management strategy that includes the definition of risk tolerance and acceptable risk response strategies. Education’s comments are reprinted in appendix VIII. The Department of Energy provided written comments in which it concurred with our two recommendations and described steps and time frames for addressing them. In one case, regarding our recommendation to update the department’s policies to address missing elements, Energy stated that, as of May 2019, it had already completed an update of its policies to implement this recommendation. We intend to follow up with the department and obtain and assess evidence to determine its implementation of this recommendation. Energy’s comments are reprinted in appendix IX. In written comments, the Department of Homeland Security stated that it was pleased that our report noted steps that DHS and OMB have taken to improve agencies’ capabilities for managing cyber risks. DHS also concurred with our two recommendations and described steps it intends to take to address them, along with estimated completion dates. DHS’s comments are reprinted in appendix XI. The department also provided technical comments, which we have incorporated as appropriate. The Department of Housing and Urban Development provided written comments in which it thanked GAO for the opportunity to review the report and stated that it concurred with the recommendations. HUD’s comments are reprinted in appendix XII. The Department of the Interior provided written comments in which it concurred with our three recommendations. Interior also described planned steps to address the recommendations, such as developing a cybersecurity risk management strategy that includes the key elements and updating its policies. The department’s comments are reprinted in appendix XIII. In written comments, the Department of Labor concurred with our recommendation. Labor stated that it intends to take necessary steps to update the department’s policies. The department’s comments are reprinted in appendix XIV. The Department of State provided written comments in which it concurred with our two recommendations. State also described steps planned or under way to address the recommendations. For example, State described ongoing policy updates to address control monitoring, system-level risk assessments, and the use of risk assessments to inform control tailoring. It also described ongoing steps to align its cybersecurity risk management activities with its ERM governance structure. State’s comments are reprinted in appendix XV. The Department of Transportation’s Director of Audit Relations & Program Improvement provided comments via email on June 25, 2019, which stated that the department concurs with the findings and recommendations in the draft report. The Department of Veterans Affairs provided written comments in which it concurred with our four recommendations. VA also described actions planned or under way to address the recommendations. Regarding our recommendation to establish and document a process for coordination between its cybersecurity and enterprise risk management functions, the department stated that it had already established such a process and requested closure of the recommendation. We intend to follow up with the department and obtain and assess evidence to determine if its actions fully address our recommendation. VA’s comments are reprinted in appendix XVI. The U.S. Agency for International Development provided written comments in which it agreed with our two recommendations. USAID also described steps it has planned or under way to address the recommendations, such as amending its guidance to address an organization-wide cybersecurity risk assessment. The agency’s comments are reprinted in appendix XVII. In written comments, the General Services Administration stated that it appreciated the opportunity to review the report and concurred with its findings. The agency added that it is implementing an action plan to address the four recommendations. GSA’s comments are reprinted in appendix XVIII. The National Aeronautics and Space Administration provided written comments in which it concurred with our two recommendations. NASA also described planned steps to address the recommendations, such as updating its policies and establishing a process for an organization-wide cybersecurity risk assessment, along with estimated completion dates. The agency’s comments are reprinted in appendix XIX. The National Science Foundation’s GAO liaison provided comments via email on July 3, 2019, which stated that the agency concurred with our recommendation and intends to update its cybersecurity risk management strategy to address the missing elements. The Nuclear Regulatory Commission provided written comments in which it stated that the agency was in general agreement with the findings and recommendations in our draft report. NRC’s comments are reprinted in appendix XX. The Office of Personnel Management provided written comments in which it stated that it concurred with our two recommendations. OPM also described planned steps to address the recommendations, such as updating its policies and establishing a process for an organization- wide cybersecurity risk assessment. The agency’s comments are reprinted in appendix XXI. In written comments, the Small Business Administration concurred with our three recommendations. SBA described steps planned or under way to address the recommendations, such as updating its cybersecurity risk management strategy and policies and establishing a process for an organization-wide cybersecurity risk assessment, along with estimated completion dates. The agency’s comments are reprinted in appendix XXII. In written comments, the Social Security Administration agreed with our recommendation and described planned efforts to further integrate its cybersecurity and enterprise risk management functions. SSA’s comments are reprinted in appendix XXIII. One agency—the Department of Health and Human Services—concurred with three of our recommendations and partially concurred with one recommendation. Specifically, HHS concurred with our recommendations to develop a risk management strategy that includes key elements, establish a process for conducting an agency-wide cybersecurity risk assessment, and establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. Further, HHS described steps planned or under way to address these recommendations. Regarding our recommendation to update department policies to require an organization-wide cybersecurity risk assessment and the use of risk assessments to inform control tailoring, HHS stated that it concurred with the first part of the recommendation, but did not concur with the second part of the recommendation. Specifically, the department described steps it has planned or under way to update its policies to require an organization-wide risk assessment, in accordance with the first part of the recommendation. With respect to the second part of the recommendation, the department pointed to portions of its information security and privacy policy that address the selection of security and privacy controls. However, while these policy statements require adherence to NIST and OMB standards for selecting security controls and require a rationale for tailoring decisions, they do not specifically require the use of risk assessments to inform the tailoring of security controls. As NIST states, organizations apply the tailoring process to align the controls more closely with the specific conditions within the organization and should use risk assessments to inform and guide the tailoring process for organizational information systems and environments of operation. Making this requirement explicit in policy would help HHS ensure that it is applying the appropriate set of controls to its systems; thus, we maintain that our recommendation is still warranted. HHS’s comments are reprinted in appendix X. The department also provided technical comments, which we incorporated as appropriate. We received technical comments via email from the GAO audit liaisons at three agencies—the Department of Commerce (on June 21, 2019), the Department of Justice (on July 8, 2019), and the Department of the Treasury (on July 3, 2019). The agencies did not state whether they agreed or disagreed with our recommendations. We incorporated their technical comments as appropriate. We received emails from Agriculture’s Director of Strategic Planning, Egovernment and Audits on June 19, 2019, and from a Division Director in the Environmental Protection Agency’s Office of Information Security and Privacy on July 8, 2019, which stated that their agencies had no comments on the draft report. We are sending copies of this report to the appropriate congressional committees, the heads of the agencies in our review, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9342 or marinosn@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix XXIV. Appendix I: Objectives, Scope, and Methodology The objectives of our review were to examine (1) the extent to which agencies established key elements of a cybersecurity risk management program; (2) what challenges, if any, agencies identified in developing and implementing cybersecurity risk management programs; and (3) what steps the Office of Management and Budget (OMB) and Department of Homeland Security (DHS) have taken to meet their risk management responsibilities under Executive Order (EO) 13800 and to address any challenges agencies face in implementing cybersecurity risk management practices. In conducting this engagement, we focused on 23 of the 24 agencies covered by the Chief Financial Officers Act of 1990. To address our first objective, we collected agency policies, procedures, and other documentation and compared them to selected key practices from OMB and National Institute of Standards and Technology (NIST) guidance for cybersecurity risk management. To identify the key practices, we reviewed OMB guidance pertaining to cybersecurity risk management, including OMB Circular A-130: Managing Information as a Strategic Resource, as well as Circular A-123: Management’s Responsibility for Enterprise Risk Management and Internal Control, which outlines agency responsibilities for enterprise risk management. We also reviewed NIST guidance, including the Framework for Improving Critical Infrastructure Cybersecurity; Special Publication 800-30: Guide for Conducting Risk Assessments; Special Publication 800-37: Guide for Applying the Risk Management Framework to Federal Information Systems, and Special Publication 800-39: Managing Information Security Risk: Organization, Mission, and Information System View. In selecting the key practices for our assessment, we focused on those practices identified by OMB and NIST as foundational for providing an organization-wide approach to cybersecurity risk management. We collected and analyzed documentation and other information from each agency related to cybersecurity risk management and compared it to the identified key practices. We supplemented our analyses with interviews with relevant agency officials to discuss the development of their policies. We discussed the results of our initial analysis of agency documentation with agency officials to validate our findings, collect additional evidence, and identify causes for any gaps. We then determined whether the evidence provided by the agency addressed each identified criteria element. Specifically, for each criteria element, we determined if the evidence fully addressed the element (“met”), addressed some, but not all, aspects of the element (“partially met”), or did not address any aspects of the element (“not met”). To address the second objective, we administered structured interview questions to the agencies to determine what challenges, if any, they face in developing and implementing policies and procedures for managing cybersecurity risk. We developed a list of potential challenges based on our assessment of agencies’ policies and procedures, a review of OMB’s risk report on agencies’ cybersecurity risk management capabilities, and reviews of prior GAO reports in areas related to cybersecurity risk management. We worked with GAO methodologists to develop a set of structured interview questions that were sent to the agencies and asked them to indicate if they faced each of these, as well as any additional, challenges, and to provide specific examples. We received responses from all 23 agencies in our review and analyzed them to identify those challenges that were indicated by a majority of the agencies. We excluded from our counts agencies that stated they did not have challenges in a particular area. We also identified common themes within the challenge areas. To address the third objective, we reviewed EO 13800 and implementation guidance issued by OMB, as well as relevant reports and other documents, including OMB’s Federal Cybersecurity Risk Determination Report and Action Plan, OMB memos, and supporting documentation for DHS initiatives. We also interviewed OMB and DHS officials with government-wide cybersecurity responsibilities to gain an understanding of initiatives under way to address their responsibilities under the order, and that could help address challenges identified by the agencies. We then compared these initiatives to the responses we received from agencies to determine if there were any gaps between the challenges and the ongoing initiatives. Specifically, for each challenge identified by a majority of the agencies in our review, we determined if any of the initiatives under way would address them based on a review of documentation associated with the initiatives as well as discussions with OMB and DHS officials. We conducted this performance audit from February 2018 to July 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Details on the Extent to Which Agencies Established a Cybersecurity Risk Executive Function Twenty-two of the 23 civilian Chief Financial Officers Act agencies in our review established and documented the role of the cybersecurity risk executive. Agencies varied in assigning this responsibility to the chief information officer (CIO), chief information security officer (CISO), or another official or entity. Table 7 provides details on our assessment. Appendix III: Details on the Extent to Which Agencies Developed a Cybersecurity Risk Management Strategy Of the 23 civilian Chief Financial Officers Act agencies, seven fully established a cybersecurity risk management strategy that included key elements recommended by National Institute of Standards and Technology (NIST) guidance. Specifically, these seven agencies developed strategies to guide how cybersecurity risk is to be framed, assessed, responded to, and monitored. In addition, five of the 23 agencies partially developed a cybersecurity risk management strategy, but their strategies did not address certain required elements. The remaining 11 agencies did not develop an agency-wide cybersecurity risk management strategy. Table 8 provides details on our assessment. Appendix IV: Details on the Extent to Which Agencies Developed Risk-Based Policies and Procedures The following elements, identified in NIST guidance, should be addressed in policies and procedures to facilitate risk-based decision making in securing information systems and data. Most of the 23 civilian Chief Financial Officers Act agencies addressed the majority of the key practices for incorporating risk-based decision- making in their policies and procedures. However, most of the agencies also had gaps in one or more of these areas. Specifically, six agencies addressed all the elements in their policies and procedures, and the remaining 17 were missing at least one. Table 10 provides details on our assessment of the agencies’ policies. Appendix V: Details on the Extent to Which Agencies Developed an Organization-Wide Cybersecurity Risk Assessment Of the 23 civilian Chief Financial Officers Act agencies, 12 developed a process for an agency-wide cybersecurity risk assessment. Specifically, these agencies developed processes for aggregating system-level data and analyzing them to assess overall cybersecurity risk to agency operations and assets. The remaining 11 agencies did not establish such a process. Table 11 provides details on our assessment. Appendix VI: Details on Agencies’ Processes for Coordination between Cybersecurity and Enterprise Risk Management Of the 23 civilian Chief Financial Officers Act agencies, 10 fully established a process or mechanism for coordination between their cybersecurity risk executive and their enterprise risk management (ERM) governance structure, five agencies partially established such a process, and the remaining eight agencies did not provide evidence of coordination. Table 12 provides details on our assessment. Appendix VII: Recommendations to Departments and Agencies We are making a total of 57 recommendations to the 23 civilian Chief Financial Officers Act agencies in our review to fully address key practices in their cybersecurity risk management policies and procedures. The Secretary of Agriculture should take the following three actions: Develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 2) Update the department’s policies to require (1) the use of risk assessments to inform security control tailoring and (2) the use of risk assessments to inform plan of actions and milestones (POA&M) prioritization. (Recommendation 3) Establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 4) The Secretary of Commerce should take the following two actions: Update the department’s policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 5) Establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 6) The Secretary of Education should take the following action: Fully develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 7) The Secretary of Energy should take the following two actions: Develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 8) Update the department’s policies to require (1) an organization-wide cybersecurity risk assessment and (2) the identification of common controls. (Recommendation 9) The Secretary of Health and Human Services should take the following four actions: Develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 10) Update the department’s policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform security control tailoring. (Recommendation 11) Establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 12) Establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 13) The Secretary of Homeland Security should take the following two actions: Develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 14) Establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 15) The Secretary of Housing and Urban Developing should take the following two actions: Develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 16) Update the department’s policies to require the use of risk assessments to inform POA&M prioritization. (Recommendation 17) The Secretary of the Interior should take the following three actions: Develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 18) Update the department’s policies to require an organization-wide cybersecurity risk assessment. (Recommendation 19) Establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 20) The Attorney General should take the following two actions: Develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 21) Fully establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 22) The Secretary of Labor should take the following action: Update the department’s policies to require (1) the use of risk assessments to inform control tailoring and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 23) The Secretary of State should take the following two actions: Update the department’s policies to require (1) an organization-wide risk assessment, (2) an organization-wide strategy for monitoring control effectiveness, (3) system-level risk assessments, (4) the use of risk assessments to inform security control tailoring, and (5) the use of risk assessments to inform POA&M prioritization. (Recommendation 24) Establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 25) The Secretary of Transportation should take the following three actions: Fully develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 26) Update the department’s policies to require an organization-wide risk assessment. (Recommendation 27) Fully establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 28) The Secretary of the Treasury should take the following three actions: Develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 29) Establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 30) Establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 31) The Secretary of Veterans Affairs should take the following four actions: Develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 32) Update the department’s policies to require an organization-wide cybersecurity risk assessment. (Recommendation 33) Establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 34) Establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 35) The Administrator of USAID should take the following two actions: Update the agency’s policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform control tailoring. (Recommendation 36) Establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 37) The Administrator of EPA should take the following four actions: Fully develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 38) Update the agency’s policies to require an organization-wide cybersecurity risk assessment. (Recommendation 39) Establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 40) Fully establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 41) The Administrator of General Services should take the following four actions: Designate and document a risk executive function with responsibilities for organization-wide cybersecurity risk management. (Recommendation 42) Update the agency’s policies to require an organization-wide cybersecurity risk assessment. (Recommendation 43) Establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 44) Fully establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 45) The Administrator of NASA should take the following two actions: Update the agency’s policies to require (1) an organization-wide risk assessment and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 46) Establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 47) We are not making a recommendation to NASA to establish a cybersecurity risk management strategy because we previously made such a recommendation, which remains open. The Director of NSF should take the following action: Fully develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 48) The Chairman of NRC should take the following four actions: Develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 49) Update the agency’s policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 50) Establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 51) Establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 52) The Director of OPM should take the following two actions: Update the agency’s policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform control tailoring. (Recommendation 53) Establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 54) The Administrator of SBA should take the following three actions: Fully develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 55) Update the agency’s policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 56) Establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 57) The Commissioner of SSA should take the following action: Fully establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 58) Appendix VIII: Comments from the Department of Education Appendix IX: Comments from the Department of Energy Appendix X: Comments from the Department of Health and Human Services Appendix XI: Comments from the Department of Homeland Security Appendix XII: Comments from the Department of Housing and Urban Development Appendix XIII: Comments from the Department of the Interior Appendix XIV: Comments from the Department of Labor Appendix XV: Comments from the Department of State Appendix XVI: Comments from the Department of Veterans Affairs Appendix XVII: Comments from the U.S. Agency for International Development Appendix XVIII: Comments from the General Services Administration Appendix XIX: Comments from the National Aeronautics and Space Administration Appendix XX: Comments from the Nuclear Regulatory Commission Appendix XXI: Comments from the Office of Personnel Management Appendix XXII: Comments from the Small Business Administration Appendix XXIII: Comments from the Social Security Administration Appendix XXIV: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the individual named above, Marisol Cruz Cain (assistant director), Lee McCracken (analyst in charge), Kiana Beshir, Roger Bracy, Chris Businsky, Alan Daigle, John de Ferrari, Nancy Glover, Franklin Jackson, Vernetta Marquis, Carlton Maynard, Scott Pettis, Tomas Ramirez, Andrew Stavisky, and Shaunyce Wallace made significant contributions to this report.