Recommendation: The Secretary of the Army should direct the Army Futures Command, in collaboration with the Army Contracting Command and the Assistant Secretary of the Army for Acquisition, Logistics, and Technology, to regularly analyze information on the use of prototype other transactions for Army modernization. (Recommendation 1)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Army should direct the Army Futures Command, in collaboration with the Army Contracting Command, to regularly analyze information on the use of grants, cooperative agreements, research other transactions, technology investment agreements, partnership intermediary agreements, and cooperative research and development agreements for Army modernization. (Recommendation 2)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Army should ensure the Commanding General of the Army Contracting Command establishes consistent practices for its headquarters to collect, archive, and share lessons learned for research and prototype other transactions, grants, cooperative agreements, technology investment agreements, and partnership intermediary agreements. (Recommendation 3)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Army should ensure the Commanding General of the Army Contracting Command has the command's contracting centers work with its headquarters to establish consistent, coordinated practices for the contracting centers to collect, analyze, validate, archive, and share lessons learned for research and prototype other transactions, grants, cooperative agreements, technology investment agreements, and partnership intermediary agreements. (Recommendation 4)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Army should ensure the Commanding General of the Combat Capabilities Development Command establishes consistent, coordinated practices for the command to collect, analyze, validate, archive, and share lessons learned for cooperative research and development agreements. (Recommendation 5)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Army should ensure an archive is established to store and share lessons learned information related to the Army's alternative approaches for engaging industry and academia. (Recommendation 6)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: Regarding financial sector cyber risk mitigation efforts, we recommend that the Secretary of the Treasury, in coordination with the Department of Homeland Security and other federal and nonfederal sector partners, track the content and progress of sectorwide cyber risk mitigation efforts, and prioritize their completion according to sector goals and priorities in the sector-specific plan. (Recommendation 1)

Agency: Department of the Treasury
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: Regarding the financial sector-specific plan, we recommend that the Secretary of the Treasury, in coordination with the Department of Homeland Security and other federal and nonfederal sector partners, update the financial services sector-specific plan to include specific metrics for measuring the progress of risk mitigation efforts and information on how the sector's ongoing and planned risk mitigation efforts will meet sector goals and requirements, such as requirements for the financial services sector in the National Cyber Strategy Implementation Plan. (Recommendation 2)

Agency: Department of the Treasury
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should ensure that the Biometric Entry-Exit Program's privacy notices contain complete and current information, including all of the locations where facial recognition is used and how travelers can request to opt out as appropriate. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should ensure that the Biometric Entry-Exit Program's privacy signage is consistently available at all locations where CBP is using facial recognition. (Recommendation 2)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should direct the Biometric Entry-Exit Program to develop and implement a plan to conduct privacy audits of its commercial partners', contractors', and vendors' use of personally identifiable information. (Recommendation 3)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should develop and implement a plan to ensure that the biometric air exit capability meets its established photo capture requirement. (Recommendation 4)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should develop a process by which Biometric Entry-Exit program officials are alerted when the performance of air exit facial recognition falls below established thresholds. (Recommendation 5)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Assistant Secretary for Research and Technology should take steps, such as updating guidance or other written communication, to ensure that the topical-research working groups (1) define and monitor progress toward achieving long-term outcomes, and (2) regularly update and monitor their charters and other written agreements to reflect these outcomes, in line with leading practices. (Recommendation 1)

Agency: Department of Transportation: Office of the Assistant Secretary for Research and Technology
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Assistant Secretary for Research and Technology should take additional steps, such as providing more specific guidance or instructions to the modal administrations on the information that should be updated or required, to ensure that the information in the Research Hub is complete and accurate. (Recommendation 2)

Agency: Department of Transportation: Office of the Assistant Secretary for Research and Technology
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of State should require Chiefs of Mission at overseas missions that receive allocations for rule of law assistance to assess the sufficiency of their coordination methods to verify that this assistance is coordinated with all relevant interagency partners. (Recommendation 1)

Agency: Department of State
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB, working with DHS, should develop a government-wide communications strategy to inform and, as appropriate, involve Congress, employees, and other stakeholders in implementation of the reform proposal to solve the cybersecurity workforce shortage. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB, working with DHS, should establish a dedicated government-wide leadership team with responsibility for implementing the reform proposal to solve the cybersecurity workforce shortage. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB, working with DHS, should develop a government-wide implementation plan with goals, timelines, key milestones, and deliverables to track and communicate implementation progress of the reform proposal to solve the cybersecurity workforce shortage. (Recommendation 3)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB, working with DHS, should provide additional information to describe how the projects and activities associated with the reform proposal to solve the cybersecurity workforce shortage will address our high-risk issues related to ensuring the cybersecurity of the nation. (Recommendation 4)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB, working with DHS, should develop a government-wide workforce plan that assesses the effects of the reform proposal to solve the cybersecurity workforce shortage on the current and future federal workforce. (Recommendation 5)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB should assess the costs and benefits of options for operating the GEAR Center. (Recommendation 6)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB should develop an implementation plan that includes outcome-oriented goals, timelines, key milestones, and deliverables to track and communicate implementation progress of the reform proposal to establish the GEAR Center. (Recommendation 7)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should update the BASE cybersecurity template to ensure it reflects cybersecurity key practices, including the Detect and Recover functions outlined in the NIST Cybersecurity Framework. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: TSA concurred with this recommendation and said it would take steps to implement it by updating the BASE Cybersecurity Security Action Item section to ensure it reflects the NIST Cybersecurity Framework Detect and Recover functions. When we confirm what actions TSA has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should direct the Director of ICE to develop a strategy for the TTU program to ensure that ICE has a plan to guide its efforts to effectively partner with existing TTUs, and to expand the program, where appropriate, into additional countries. (Recommendation 1)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should direct the Director of ICE to develop a performance monitoring framework for the TTU program that would enable the agency to systematically track program results and how effectively it is achieving the program's goals. (Recommendation 2)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should designate a dedicated entity to provide oversight of agency-wide efforts to detect, prevent, and resolve business IDT, consistent with leading practices. This may involve designating one business unit as a lead entity or leveraging cooperative relationships between business units to establish a business IDT leadership team. This entity should have defined responsibilities and authority for managing fraud risk. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: In January 2020, IRS agreed to designate a dedicated entity to provide oversight of agency-wide business IDT efforts and stated that it will determine the appropriate oversight structure and scope of authority.

Recommendation: The Commissioner of Internal Revenue should develop a fraud risk profile for business IDT that aligns with leading practices. This should include (1) identifying inherent fraud risks of business IDT, (2) assessing the likelihood and impact of inherent fraud risks, (3) determining fraud risk tolerance, and (4) examining the suitability of existing fraud controls. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: In January 2020, IRS agreed but did not provide details on the actions it plans to take to address the recommendation.

Recommendation: The Commissioner of Internal Revenue should develop, document, and implement a strategy for addressing fraud risks that will be identified in its fraud risk profile. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In January 2020, IRS agreed but did not provide details on the actions it plans to take to address the recommendation.

Recommendation: The Commissioner of Internal Revenue should ensure that IRS collects additional data on business IDT by identifying and implementing new fraud filters consistent with its fraud risk profile. This should include prioritizing IDT filters for tax forms determined to be most at risk based on an analysis of risk tolerances. (Recommendation 4)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In January 2020, IRS agreed but did not provide details on the actions it plans to take to address the recommendation.

Recommendation: The Commissioner of Internal Revenue should identify and implement methods to address delays in resolving business IDT cases due to correspondence-based authentication. This could involve using different methods for taxpayer authentication based on the risk level of the return. (Recommendation 5)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with the recommendation. In January 2020, IRS stated that it will complete an analysis of other authentication methods.

Recommendation: The Commissioner of Internal Revenue should establish customer service-oriented performance goals for resolving business IDT cases. (Recommendation 6)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS neither agreed nor disagreed with our recommendation to establish customer service-oriented performance goals for resolving business identity theft cases. In January 2020, IRS stated that it will review its customer service-oriented performance goals and modify them, as warranted, to address the resolution of business identity theft cases. Doing so would meet the intent of our recommendation.

Recommendation: The Director of Water Security of EPA, as Chair of the Water Sector Government Coordinating Council, should work with the council to identify existing technical assistance providers and engage these providers in a network to help drinking water and wastewater utilities incorporate climate resilience into their projects and planning on an ongoing basis. (Recommendation 1)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: In June 2020, EPA said that it will continue to work with its wide-ranging, existing technical assistance providers and coordinate with its stakeholders to identify additional providers as applicable. According to the agency, it is already taking action on the recommendation. While we agree that EPA should continue to work with its providers to improve technical assistance to utilities, our recommendation was for EPA to work with stakeholders to develop a network to provide coverage for the many drinking water and wastewater utilities across the country. EPA has not provided information to show that its plans will develop such a network. We will continue to monitor this recommendation to determine how the agency is working with stakeholders to build a network of providers.

Recommendation: The SBA Administrator should assign and document clear roles, responsibilities, and reporting lines for headquarters offices' implementation of SBA's plan for addressing the White House Initiative on HBCUs in a timely manner. (Recommendation 1)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Associate Administrator of the Office of Entrepreneurial Development should take and document steps to ensure that the office's reporting mechanisms collect the information needed to establish a baseline for, and also inform future monitoring and assessment of, efforts to support HBCUs. (Recommendation 3)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Associate Administrators of the Office of Entrepreneurial Development and Office of Field Operations should communicate planned efforts to support HBCUs, including expectations, goals, and related measures, to the district offices and Small Business Development Centers with HBCUs in their service areas. (Recommendation 2)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The NOAA Administrator, in coordination with interagency committee member agencies, should establish a time frame for documenting the committee's membership process. (Recommendation 1)

Agency: Department of Commerce: National Oceanic and Atmospheric Administration
Status: Open

Comments: In February 2020, NOAA stated that its Administrator, in consultation with interagency committee member agencies, will determine criteria and other factors for evaluating federal agency interest and will formalize and document the interagency committee's membership process. NOAA anticipates documenting the process in the committee's charter by August 31, 2020.

Recommendation: The NOAA Administrator, in coordination with interagency committee member agencies, should clarify what is meant by "senior official" in the Marine Debris Act, such as through revisions to its charter. (Recommendation 2)

Agency: Department of Commerce: National Oceanic and Atmospheric Administration
Status: Open

Comments: In February 2020, NOAA stated that the agency, in coordination with interagency committee member agencies, will define the term "senior official" so that it can be consistently applied across all member agencies. NOAA stated it will consider seniority requirements of similar advisory committees and the ability to make decisions on behalf of an agency, among other factors, when developing the definition. NOAA plans to include the definition in the committee's charter by August 31, 2020.

Recommendation: The chair of the interagency committee, in coordination with member agencies, should develop and implement a process to analyze the effectiveness of the interagency committee's recommendations and strategies, and include the results in its biennial reports. (Recommendation 3)

Agency: Interagency Marine Debris Coordinating Committee
Status: Open

Comments: In February 2020, NOAA stated the agency will work with interagency committee member agencies to review and update the committee's recommendations. As part of this process, the committee will develop metrics to analyze the effectiveness of the committee's recommendations and strategies. NOAA stated that the recommendations and assessment of effectiveness will be included in the committee's 2018-2019 biennial report, which NOAA expects to publish by December 31, 2020.

Recommendation: The chair of the interagency committee, in coordination with member agencies, should develop a process to identify recommendations for priority funding needs to address marine debris, and include such recommendations in its biennial reports. (Recommendation 4)

Agency: Interagency Marine Debris Coordinating Committee
Status: Open

Comments: In February 2020, NOAA stated that it will, in coordination with interagency committee member agencies, develop a process to identify priority funding needs which can be reflected in each agency's respective budgeting process and shared in the committee's biennial reports. NOAA expects to publish the committee's 2018-2019 biennial report by December 31, 2020.

Recommendation: The Secretary of Commerce should direct the National Institute of Standards and Technology (NIST) Director to work with other sponsoring federal agencies to develop and implement network-wide performance goals for the Manufacturing USA program with measurable targets and time frames. (Recommendation 1)

Agency: Department of Commerce
Status: Open

Comments: Commerce partially concurred with this recommendation according to its response to our report. Commerce stated that it lacks the legal authority to compel action by other federal agencies, and that legal constraints aside, it believes it is bad management practice to ask institutes to respond to performance goals issued by different bodies. As of March 2020, Commerce stated that it plans to report on performance goals for Commerce-sponsored institutes effective with the 2019 annual report, which it expects to issue by September 2020. Commerce also agreed to continue working closely with other sponsoring federal agencies on program and network goals for the Manufacturing USA institutes, but did not commit to working with sponsoring federal agencies to develop and implement network-wide performance goals with measurable targets and time frames. We recognize that Commerce does not have management authority over other the institutes sponsored by other agencies. We believe our report sufficiently characterizes the development of network-wide performance goals, targets, and time frames as a collaborative effort between Commerce and sponsoring agencies that is in keeping with Commerce's network-wide coordination functions under the RAMI Act. Moreover, our recommendation specifically pertained to developing performance goals for the Manufacturing USA program, not individual institutes. As we stated in our report, this would not necessarily entail new performance measures but, rather, could consist of measurable near-term performance goals corresponding to program performance measures already in place. Further, as stated in our report, GAO's prior work has shown that systems of performance measures benefit from certain key practices, such as creating a hierarchy that breaks down broad, long-term goals and objectives into more specific, near-term performance goals with measurable targets and time frames. Our recommendation was designed to ensure that the Manufacturing USA program performance measurement structure that Commerce has already worked with the other sponsoring agencies to develop more fully aligns with these key practices. We continue to believe that by working with other sponsoring federal agencies to develop and implement network-wide performance goals with targets and time frames, Commerce would be better able to observe and report on progress toward long-term Manufacturing USA program goals and objectives.

Recommendation: The Secretary of Commerce should direct the NIST Director to work with other sponsoring federal agencies to ensure that the Manufacturing USA network-wide performance measures are directly aligned with the network-wide performance goals, the Manufacturing USA strategic objectives and program goals, and the statutory purposes of the Revitalize American Manufacturing and Innovation (RAMI) Act. (Recommendation 2)

Agency: Department of Commerce
Status: Open

Comments: Commerce partially concurred with this recommendation according to its response to our report. In March 2020, Commerce stated that it supports the alignment of performance measures with performance goals only for Commerce-sponsored institutes. Commerce stated that it is unable to commit to this recommendation as 13 of the 14 existing institutes were authorized under authorities other than the RAMI Act and are sponsored by agencies other than Commerce. Commerce also stated that, until additional institutes authorized by the RAMI Act are in place, it does not support additional performance measures for the single Commerce-sponsored institute beyond the RAMI Act requirements, as doing so would impose an unfair level of scrutiny. Commerce agreed to report on performance metrics for department-sponsored institutes effective with the current annual report, which is expected by September 2020. We recognize that Commerce does not have management authority over other the institutes sponsored by other agencies. We believe our report sufficiently characterizes the effort to align the network-wide performance measures with network-wide performance goals and Manufacturing USA program goals as a collaborative effort between Commerce and sponsoring agencies that is in keeping with Commerce's coordination functions under the RAMI Act. Our recommendation does not ask Commerce to compel actions by other agencies, nor to develop any additional performance measures. As noted in our report, the Manufacturing USA program's performance measurement structure aligns near-term performance measures directly to the program's long-term goals. This structure bypasses connecting the performance measures with the program's objectives that have been developed to break down the long-term goals more specifically. GAO's prior work has shown that systems of performance measures benefit from certain key practices, such as creating a hierarchy that breaks down broad, long-term goals and objectives into more specific, near-term performance goals with measurable targets and time frames. Our recommendation was designed to ensure that the Manufacturing USA program performance measurement structure that Commerce has already worked with the other sponsoring agencies to develop more fully aligns with these key practices. We continue to believe that by working with other sponsoring federal agencies to ensure that the Manufacturing USA network-wide performance measures are directly aligned with the Manufacturing USA strategic program goals and objectives and the statutory purposes of the RAMI Act, Commerce would be better able to observe and report on progress made toward achieving the statutory purposes of the Manufacturing USA program.

Recommendation: The Secretary of Commerce should direct the NIST Director to develop criteria to evaluate whether the Commerce-sponsored institute can sustain its operations without additional federal financial assistance after its initial agreement. If an analysis based on such criteria indicates that additional federal financial assistance is needed to help the institute sustain its operations, then the Secretary of Commerce should consider a legislative proposal to amend relevant provisions of the RAMI Act. (Recommendation 3)

Agency: Department of Commerce
Status: Open

Comments: Commerce partially concurred with this recommendation according to its response to our report. In March 2020, Commerce stated that it will develop criteria to evaluate the sufficiency of the Commerce-sponsored institute's sustainability plan based on the anticipated operating costs of the institute at fully operational steady state, and the likelihood of sustaining those operations through the specific efforts outlined in the sustainability plan. Commerce stated that it plans to develop the evaluation criteria by April 2020. We will update this recommendation after we learn more about these efforts.

Recommendation: The Secretary of Defense should direct the Director of DOD's Manufacturing USA institutes to develop criteria to evaluate whether DOD-sponsored institutes can sustain their operations without additional federal financial assistance after their initial agreements. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with this recommendation. According to information DOD provided in March 2020, DOD developed criteria to evaluate whether each DOD-sponsored institute is effectively executing its mission, providing value to the department, and transitioning advanced manufacturing to U.S. manufacturers, while demonstrating progress toward business viability (diversified revenue, controlled costs, etc.). As of March 2020, DOD plans to incorporate these criteria into a strategic management plan, under which the department will review institutes' progress at the end of their agreements to determine the type and level of DOD's continued participation. DOD expects to complete work on the strategic management plan by the end of September 2020.

Recommendation: The Secretary of Energy should direct the Director of DOE's Manufacturing USA institutes to develop criteria to evaluate whether DOE-sponsored institutes can sustain their operations without additional federal financial assistance after their initial agreements. (Recommendation 5)

Agency: Department of Energy
Status: Open

Comments: DOE concurred with this recommendation according to its response to our report. In September 2019, DOE stated that it will direct the Directors of DOE-sponsored institutes to collectively work toward updating institute sustainability plans and activities and collaboratively develop criteria and metrics to assess the institutes' progress toward financial sustainability. After development of the metrics, DOE will track as appropriate. As of March 2020, DOE reported agreement with its institutes on an initial set of criteria and metrics to assess progress toward financial sustainability. We will update this recommendation as we collect more information about these efforts.

Recommendation: The Under Secretary of Transportation for Policy should ensure that the Build America Bureau develop a detailed implementation plan that sets goals and a timeline for the Bureau's continued efforts, fills vacancies in the Bureau, and prioritizes and sequences work to carry out the multiple responsibilities given to the Bureau in the FAST Act. (Recommendation 1)

Agency: Department of Transportation
Status: Open

Comments: As of July 2020, DOT is planning to develop a strategy with goals and objectives to guide the Bureau's work and to complete this action by August 2020. DOT stated it does not plan to create a detailed implementation plan as that would detract from higher priority efforts. We will continue to monitor DOT's actions and the extent to which they fulfill our recommendation.

Recommendation: The Under Secretary of Transportation for Policy should ensure that the Build America Bureau develop performance indicators to assess the Bureau's progress toward meeting its guiding principles or mission as a "one-stop shop." (Recommendation 2)

Agency: Department of Transportation
Status: Open

Comments: As of July 2020, DOT is planning to establish a baseline that tracks the average amount of time that projects spend in each of the key developmental phases to assess how long projects take to reach financial close and to complete this action by August 2020. This planned baseline and measure would align with one of the Bureau's four guiding principles, but additional measures would be needed to gauge its overall progress in meeting the Bureau's other guiding principles. We will continue to monitor DOT's actions and the extent to which they fulfill our recommendation.

Recommendation: The Under Secretary of Transportation for Policy should ensure that the Build America Bureau develop a mechanism to assess the Bureau's application evaluation process for TIFIA and RRIF and identify and address opportunities to improve and further streamline the process. This evaluation should include mechanisms to solicit feedback from project sponsors that sought financing. (Recommendation 3)

Agency: Department of Transportation
Status: Open

Comments: As of July 2020, the Bureau is planning to develop a survey to solicit feedback from project sponsors on their experience with the Bureau and to have an approved survey ready for use by August 2020. We will continue to monitor DOT's actions and the extent to which they fulfill our recommendation.

Recommendation: The Under Secretary of Transportation for Policy should ensure that the Build America Bureau develop and adopt a public statement that outlines DOT's and the Bureau's policy goals and appetite for risk for the TIFIA and RRIF financing programs. (Recommendation 4)

Agency: Department of Transportation
Status: Open

Comments: As of July 2020, DOT is planning to develop a strategy that outlines the Bureau's policy goals, but does not intend to issue a public statement that outlines DOT's and the Bureau's appetite for risk. According to DOT, a risk appetite statement would not be feasible given that the loan programs in the Bureau cover a diverse portfolio of publicly and privately funded projects covering a range of transportation modes that range widely in size, complexity, and financial structure. We informed DOT that we continue to believe that a risk appetite statement is both feasible and needed. DOT plans to provide an updated response in October 2020. We will review the Department's response and continue to monitor its actions and determine the extent to which they fulfill our recommendation.

Recommendation: FTA should determine which on-demand services qualify as "public transportation" based on the statutory definition and disseminate information to clarify whether and how to report data from such services into the National Transit Database (NTD). (Recommendation 2)

Agency: Department of Transportation: Federal Transit Administration
Status: Open

Comments: DOT concurred with this recommendation. As of September 2018, FTA planned to implement it by updating its NTD manual to include a new data collection field for on-demand services provided by Transportation Network Companies (TNC) in order to track these separately from other types of on-demand services. FTA will post a proposed update to clarify whether and how to report TNC-provided services into the NTD. FTA plans to post the proposed revisions along with specifications for which on-demand services qualify as "Public transportation" to the NTD policy in the Federal Register for comment. As of May 2020, FTA anticipated completing these actions by November 30, 2020.

Recommendation: The Secretary of Agriculture, in cooperation with the Secretary of Health and Human Services, should take steps to consult with respective sector partner(s), such as the sector coordinating council (SCC), Department of Homeland Security (DHS) and NIST, as appropriate, to develop methods for determining the level and type of framework adoption by entities across their respective sector. (Recommendation 1)

Agency: Department of Agriculture
Status: Open
Priority recommendation

Comments: In written comments, United States Department of Agriculture (USDA) neither agreed nor disagreed with the recommendation in our report, but stated that it would attempt to develop a measurement mechanism as part of its annual data calls to the Food and Agriculture Sector. Specifically, officials stated that the diversity of the sector makes it difficult to develop a method for determining the level and type of framework adoption across the sector that would apply to all members. USDA officials added, however, that the sector coordinating council frequently invites the Department of Homeland Security to semi-annual meetings to present on both the threat to cybersecurity and resources available to support the needs of the sector. However, as of January 2020, USDA officials had yet to develop methods to determine the level and type of framework adoption. Implementing our recommendations to gain a more comprehensive understanding of the framework's use by critical infrastructure sectors is essential to the success of protection efforts.

Recommendation: The Secretary of Energy should take steps to consult with respective sector partner(s), such as the SCC, DHS and NIST, as appropriate, to develop methods for determining the level and type of framework adoption by entities across their respective sector. (Recommendation 3)

Agency: Department of Energy
Status: Open
Priority recommendation

Comments: The Department of Energy (DOE) stated that it worked with stakeholders to better align the Cybersecurity Capability Maturity Model (C2M2) with the updated NIST Cybersecurity Framework but did not provide specific information regarding the adoption or use of the framework. To fully address the recommendation, DOE should have a more comprehensive understanding of the framework's use by sector entities if DOE, along with other entities, want to ensure that its facilitation efforts are successful and determine whether organizations are realizing positive results by adopting the framework. We will continue to monitor DOE actions in response to this recommendation.

Recommendation: The Administrator of the Environmental Protection Agency should take steps to consult with respective sector partner(s), such as the SCC, DHS and NIST, as appropriate, to develop methods for determining the level and type of framework adoption by entities across their respective sector. (Recommendation 4)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: In written comments, EPA did not explicitly state whether it agreed or disagreed with our recommendation, but said that several factors constrain the agency from implementing the recommendation. EPA also said it agrees that a comprehensive assessment of framework adoption within the water sector would assist with evaluating and tailoring efforts to promote its use. Further, the agency stated that it will continue to work with the Water Sector Coordinating Council and sector partners to promote and facilitate adoption of the cybersecurity framework. The agency also suggested options related to developing cross-sector metrics and survey methods and stated that it will collect available data that may be characterized as cybersecurity framework "awareness," such as downloads of guidance materials and participation in classroom trainings and webinars. However, as of February 2020, EPA had yet to develop methods to determine the level and type of framework adoption. Officials identified steps the department is taking to facilitate framework use. Specifically, EPA officials told us that the agency will coordinate with its Sector Coordinating Council to identify appropriate means to collect and report information, including a survey, to determine the level and type of framework adoption. They explained that, in the past, the water sector expressed concerns with sharing sensitive cybersecurity information and in developing metrics to evaluate cybersecurity practices. . However, EPA officials stated that they have conducted training, webcasts, and outreach related to cybersecurity, including using the framework and tailoring its efforts to sector needs. According to EPA officials, the agency's goal in doing so was to ensure that sector organizations understood the importance of the framework. While the agency has some ongoing initiatives, implementing our recommendation to gain a more comprehensive understanding of the framework's use by its critical infrastructure sector is essential to the success of protection efforts.

Recommendation: The Secretary of Health and Human Services, in cooperation with the Secretary of Agriculture, should take steps to consult with respective sector partner(s), such as the SCC, DHS and NIST, as appropriate, to develop methods for determining the level and type of framework adoption by entities across their respective sector. (Recommendation 6)

Agency: Department of Health and Human Services
Status: Open
Priority recommendation

Comments: In written comments, the Department of Health and Human Services (HHS) concurred with the recommendation in our report and stated that it would work with appropriate entities to assist in sector adoption. HHS officials, in collaboration with NIST and a joint Cybersecurity Working Group, developed 10 best practices in May 2017 (Health Industry Cybersecurity Practices) for the Healthcare and Public Health Services sector based on the framework. These practices allowed stakeholders to identify how to use the framework with existing sector resources by raising awareness and providing vetted cybersecurity practices to enable the organizations to mitigate cybersecurity threats to the sector. In addition, officials from HHS's Assistant Secretary for Preparedness and Response (ASPR) stated that the working group discussed the challenges associated with measuring the use and impact of the NIST framework, and approved the establishment of a task group to further investigate the issue. ASPR officials added that some of the ideas discussed included the use of surveys and identification of a set of voluntary reporting indicators. In its fiscal year 2021 budget justification, HHS noted that it participated in a Health Care SCC Cybersecurity Working Group survey that was sent to group members in June 2019. However, while the survey included a question on the extent a working group member used the framework, SCC officials stated that the survey results were not statistically meaningful. While the department has ongoing initiatives, it had yet to develop methods to determine the level and type of framework adoption. Implementing our recommendations to gain a more comprehensive understanding of the framework's use by critical infrastructure sectors is essential to the success of protection efforts.

Recommendation: The Secretary of Homeland Security, in cooperation with the co-SSAs as necessary, should take steps to consult with respective sector partner(s), such as the SCC, and NIST, as appropriate, to develop methods for determining the level and type of framework adoption by entities across their respective sectors. (Recommendation 7)

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: In written comments, the Department of Homeland Security (DHS) concurred with the recommendation in our report and stated that its National Protection and Programs Directorate, as the sector-specific agency for 9 of the 16 critical infrastructure sectors, will continue to work closely with its private sector partners to ensure framework adoption is a priority. Additionally, the department stated that the directorate will work closely with its private sector partners to better understand the extent of framework adoption and barriers to adoption by entities across their respective sectors. As of January 2020, the department had begun taking steps to develop methods to determine the level and type of framework adoption in the respective sectors. Specifically, in October 2019, DHS, in coordination with its Information Technology (IT) sector partner, administered a survey to all small and midsized IT sector organizations to gather information on, among other things, framework use and plans to report on the results in 2020. DHS officials stated that any small or mid-sized business across all critical infrastructure sectors could complete the survey and that the department had promoted the survey to all sectors.

Recommendation: The Secretary of Transportation, in cooperation with the Secretary of Homeland Security, should take steps to consult with respective sector partner(s), such as the SCC, DHS and NIST, as appropriate, to develop methods for determining the level and type of framework adoption by entities across their respective sector. (Recommendation 8)

Agency: Department of Transportation
Status: Open
Priority recommendation

Comments: As of January 2020, the department had begun taking steps to develop methods to determine the level and type of framework adoption in the respective sectors. Specifically, officials in the Department of Transportation's (DOT) Office of Intelligence, Security, and Emergency Response, in coordination with the Department of Homeland Security (DHS), told us that they planned to develop and distribute a survey to the Transportation Systems sector to determine the level and type of framework adoption. DOT officials stated that the draft survey was undergoing DHS legal review and that the completion of the review and subsequent Office of Management and Budget review would determine when the survey is approved for distribution.

Recommendation: The Secretary of Treasury should take steps to consult with respective sector partner(s), such as the SCC, DHS and NIST, as appropriate, to develop methods for determining the level and type of framework adoption by entities across their respective sector. (Recommendation 9)

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: The Department of the Treasury neither agreed nor disagreed with the recommendation in our report. The department stated that it will assess using the identified initiatives and their viability for collecting and reporting sector-wide improvements from use of the framework with input from the sector coordinating council (SCC) and financial regulators. However, as of January 2020, the department had yet to develop methods to determine the level and type of framework adoption. Treasury officials stated that the department, in coordination with the Financial and Banking Information Infrastructure Committee, and in consultation with NIST, developed the Cybersecurity Lexicon in March 2018. The lexicon addressed, among other things, common terminology for cyber terms used in the framework. Additionally, the Financial Services sector, in consultation with NIST, created the Financial Service Sector Cybersecurity Profile (profile) in October 2018, which mapped the framework core to existing regulations and guidance, such as the Commodity Futures Trading Commission System Safeguards Testing Requirements. Officials stated that these efforts will facilitate the use of the framework. However, while the department has ongoing initiatives, implementing our recommendations to gain a more comprehensive understanding of the framework's use by critical infrastructure sectors is essential to the success of protection efforts.

Recommendation: To enhance interagency collaboration in the Manufacturing USA program, the Secretary of Commerce should direct the Director of the National Institute of Standards and Technology to work with all non-sponsoring agencies whose missions contribute to or are affected by advanced manufacturing to revise the Manufacturing USA governance system to ensure the roles and responsibilities for how these agencies could contribute to the Manufacturing USA program are fully identified.

Agency: Department of Commerce
Status: Open

Comments: In October 2019, the National Institute of Standards and Technology (NIST) reported that, working through the Manufacturing USA interagency team and the National Science and Technology Subcommittee on Advanced Manufacturing, it had revised the Manufacturing USA governance document to include a section defining roles related to facilitating information sharing for agencies who are not sponsoring Manufacturing USA institutes. We are seeking clarification from NIST on which non-sponsoring agencies are covered by the new section. We will revisit the status of this recommendation once we receive clarification.

Recommendation: To fulfill the role assigned to it under the 1980 Act, the Secretary of Commerce should engage with industry stakeholders and continually identify and assess critical materials needs across a broad range of industrial sectors.

Agency: Department of Commerce
Status: Open

Comments: In December 2016, Commerce provided information on its implementation of the recommendation from GAO-16-699. Commerce stated that it had developed an action plan consisting of the following steps: (1) consulting with relevant offices and agencies, including: OSTP, DOD, the U.S. Geological Survey, DOE, the U.S. International Trade Commission, the Bureau of Industry and Security, the National Institute of Standards and Technology, and the National Oceanic and Atmospheric Administration; (2) determining criteria to be used when it is necessary to collect information to identify and assess critical materials needs; (3) determining appropriate steps, which might include: (a) developing a summary of information that federal agencies currently collect on the domestic and international supply of critical raw materials; (b) soliciting input from a broad range of industries through a Federal Register notice; (c) assessing aggregate information, as allowable under law, that is submitted through the Miscellaneous Tariff Bill process over the course of fiscal year 2017; and (d) consulting with federal advisory groups for advice; (4) determining the audience for collected information and methodology for information dissemination; (5) determining the process for identifying further information collection needs and methodology for disseminating collected information; and (6) determining the timeline and responsibilities for information collection and distribution. In an April 2017 update, Commerce stated that it had identified points of contacts in seven of the eight agencies listed in its action plan and is in the process of contacting them for input. Commerce stated that it hoped to identify an appropriate contact in the eighth agency in the near future. Commerce stated that it had also drafted questions to ask the agencies in order to implement the action plan. Commerce did not provide a timeframe for when it expected to complete implementation of the action plan. In a June 2018 update, Commerce stated that since the change in Administration, Commerce has not been able to identify staff in all agencies to work with, but that Commerce is now in contact with several agencies who are aware of industry needs. Commerce did not provide a timeframe for when it expected to complete execution of its action plan. We requested additional information on Commerce's efforts to implement this recommendation, including plans to solicit industry input, and will update the status of the recommendation based on additional information received.

Recommendation: To enhance the ability of the Executive Office of the President to coordinate federal agencies to carry out the national materials policy outlined in the 1980 Act, and to broaden future applications of the early warning screening methodology, the Subcommittee should take the steps necessary to include potentially critical materials beyond minerals, such as developing a plan or strategy for prioritizing additional materials for which actions are needed to address data limitations.

Agency: Executive Office of the President: Office of Science and Technology Policy
Status: Open

Comments: In September 2017, OSTP provided updated information on its efforts to implement recommendations from GAO-16-699. OSTP stated that "the Subcommittee shares GAO's interest in improving data availability and granularity. However, in some cases, private entities and foreign governments may be unwilling or unable to provide (or even collect) such data. Additionally, the Subcommittee member agencies' financial and personnel resources are limited, and significant additional resources would be required to prioritize and pursue the data for additional materials and critical materials beyond minerals. Without the appropriation of additional resources, the Subcommittee's work on these additional items will be necessarily circumscribed." In its February 2018 report on the updated application of the early warning screening methodology, the Subcommittee stated that it saw the value in analyzing more minerals and non-minerals to help inform policy decisions, but that fulfilling this need will require additional dedicated personnel and financial resources for data collection, analysis, and distribution. In March 2020, OSTP stated that the Subcommittee has explored the possibility of expanding the scope of the early warning screening methodology to include critical materials beyond minerals. According to OSTP, possible expansion candidates include carbon fiber and critical chemicals. OSTP stated that it has initiated a discussion with the Department of Interior (U.S. Geological Survey), who has been leading the methodology development, and the Department of Commerce (Bureau of Economic Analysis) with regard to possible data that would be needed for such an expansion. In August 2020, OSTP stated that the expertise to expand data collection to additional materials of interest exists in the National Minerals Information Center (NMIC) at the U.S. Geological Survey; however, the capacity to expand beyond the current portfolio is not available due to budgetary constraints. We will update this recommendation when we obtain additional information on these efforts.