Recommendations for Executive Action

1. Status: Closed - Implemented

   Comments: In December 2014, we reported that DHS lacks a strategy that defines the problem, identifies the roles and responsibilities, analyzes the resources needed, and identifies a methodology for assessing cyber risk to building and access control systems. The lack of a strategy was also reflected in DHS's guidance to federal agencies on reporting cyber incidents involving building and access control systems. Before October 1, 2014, DHS's guidance for federal agencies on reporting computer security incidents did not specify that information systems include industrial control systems, of which building and access control systems are a subset. A DHS director said that the lack of clear guidance on reporting cyber incidents involving industrial control systems may have contributed to the lack of incident reporting by federal agencies. From fiscal year 2010 to August 2014, out of 851 reported industrial control system incidents, DHS received only one from a federal agency. On October 1, 2014, DHS issued guidance clarifying that information systems include industrial control systems and that federal agencies should report all information security incidents to DHS. A DHS official said that the guidance was clarified in part because of questions that we raised during our review. As a result, the clarified guidance should help inform federal agencies about reporting cyber incidents involving industrial (e.g.building and access control systems)control systems and increase agencies reporting of such incidents.

   Recommendation: The Secretary of Homeland Security, in consultation with GSA, should develop and implement a strategy to address cyber risk to building and access control systems that, among other things: (1) defines the problem; (2) identifies roles and responsibilities; (3) analyzes the resources needed; and (4) identifies a methodology for assessing this cyber risk.

   Agency Affected: Department of Homeland Security

2. Status: Closed - Implemented

   Comments: In December 2014, we reported that building and access control systems--computers that monitor and control building operations such as elevators, electrical power, and heating, ventilation, and air conditioning--in federal facilities are increasingly being connected to other information systems and the internet, which heightens their vulnerability to cyber attacks. However, the Interagency Security Committee, which is housed within DHS and is responsible for developing physical security standards for nonmilitary federal facilities, had not incorporated cyber threats to building and access control systems in its Design-Basis Threat report, which identifies and describes numerous undesirable events under various scenarios and their probability of occurring as well as establishing a profile of the types, composition, and capabilities of adversaries. We recommended that DHS direct the Interagency Security Committee to incorporate the cyber threat to building and access control systems into the Committee's list of undesirable events in its Design-Basis Threat report. In response, in January 2016, the Interagency Security Committee issued a revised version of this report which incorporated the cyber threat to building and access control systems into the list of undesirable events. As a result of the action, agencies will be informed about this threat and can begin to assess its risk, which will enhance federal facility cybersecurity.

   Recommendation: The Secretary of Homeland Security should direct ISC to incorporate the cyber threat to building and access control systems into ISC's list of undesirable events in its Design-Basis Threat report.

   Agency Affected: Department of Homeland Security

3. Status: Closed - Implemented

   Priority recommendation

   Comments: Federal facilities contain building and access control systems--computers that monitor and control building operations such as elevators, electrical power, and heating, ventilation, and air conditioning--that are increasingly being connected to other information systems and the Internet. The increased connectivity heightens their vulnerability to cyber attacks, which could compromise security measures, hamper agencies' ability to carry out their missions, or cause physical harm to the facilities or their occupants. In 2014, GAO reported that GSA had not fully assessed the risk of building control systems to a cyber attack in a manner that is consistent with the Federal Information Security Management Act of 2002 (FISMA) or its implementation guidelines. GAO also reported that GSA had not conducted security control assessments of the systems in all of its 1,500 facilities. Therefore, GAO recommended that GSA assess the control systems that it owns in a manner that is fully consistent with FISMA and its implementation guidelines. In 2017, GAO confirmed that out of 1,533 facilities, GSA had completed cyber risk assessments of the control systems or that assessments were not needed in all but 142 lower-risk facilities. GSA plans to assess the cyber risk of the systems in those remaining facilities by contacting property management staff or conducting site visits. As a result, GSA's action increases federal facility security by reducing the risk of cyber attacks on control systems.

   Recommendation: The Administrator of the General Services Administration should assess the building and access control systems that it owns in FPS-protected facilities in a manner that is fully consistent with FISMA and its implementation guidelines.

   Agency Affected: General Services Administration

Explore the full database of GAO's Open Recommendations »