Please note that a lapse in appropriations has caused GAO to shut down its operations. Therefore, GAO will not be able to publish reports or otherwise update this website until GAO resumes operations. In addition, the vast majority of GAO personnel are not permitted to work. Consequently, calls or emails to agency personnel may not be returned until GAO resumes operations. For details on how the bid protest process will be handled during the shutdown, please see the legal decisions page. For information related to the GAO Personnel Appeals Board (PAB), please see the PAB webpage.
The Cybersecurity Program Audit Guide (CPAG) provides guidance to identify cybersecurity program weaknesses and develop appropriate recommendations for corrective actions. This guide is intended for Congress, federal agencies, state and local auditors, the private sector, and non-profits. The guide is to be used in conducting cybersecurity performance audits.
Developed with the help of federal officials as well as industry experts, this guidebook outlines the methodology for performing cybersecurity control audits in accordance with professional standards. The CPAG’s six main components and control activities are consistent with policies and guidance from the National Institute of Standards and Technology (NIST) and the Office of Management and Budget.
