Recommendation: The Secretary of Homeland Security should ensure that integrators' solutions provide unique identifiers for hardware on selected agencies' networks. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should ensure that FAA's system integrator records FISMA system information in the agency's CDM tools. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should ensure that IHS's system integrator records FISMA system information in the agency's CDM tools. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should ensure that FAA's system integrator establishes a process to integrate all vulnerability information in the agency's CDM tools, including the time a vulnerability was remediated. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should ensure that IHS's system integrator establishes a process to integrate all vulnerability information in the agency's CDM tools, including the time a vulnerability was remediated. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should ensure that SBA's system integrator establishes a process to integrate all vulnerability information in the agency's CDM tools, including the time a vulnerability was remediated. (Recommendation 6)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FAA Administrator should commit to a time frame to complete the agency's effort to associate hardware with its FISMA systems. (Recommendation 7)

Agency: Department of Transportation: Federal Aviation Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FAA Administrator should document agency-specific variations from federal core configuration benchmarks for each operating system on its network. (Recommendation 8)

Agency: Department of Transportation: Federal Aviation Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FAA Administrator should configure its CDM tools to compare configuration settings against federal core benchmarks and agency-specific variations applicable to its environment. (Recommendation 9)

Agency: Department of Transportation: Federal Aviation Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of IHS should document approved hardware inventory information by associating FISMA systems with the hardware on its network in a format that can be readily integrated into its CDM tools. (Recommendation 10)

Agency: Department of Health and Human Services: Public Health Service: Indian Health Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of IHS should document agency-specific variations from federal core configuration benchmarks for each operating system on its network. (Recommendation 11)

Agency: Department of Health and Human Services: Public Health Service: Indian Health Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of IHS should configure its CDM tools to compare configuration settings against federal core benchmarks applicable to its environment. (Recommendation 12)

Agency: Department of Health and Human Services: Public Health Service: Indian Health Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The SBA Administrator should commit to a time frame to complete the agency's effort to associate hardware with its FISMA systems. (Recommendation 13)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The SBA Administrator should document agency-specific variations from federal core configuration benchmarks for each operating system on its network. (Recommendation 14)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The SBA Administrator should configure its CDM tools to compare configuration settings against agency-specific benchmarks applicable to its environment. (Recommendation 15)

Agency: Small Business Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of the Office of Management and Budget should (1) require that agencies explicitly document annual data center closure goals in their DCOI strategic plans and (2) track those goals on the IT Dashboard. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) has not yet taken action to address this recommendation. We will continue to monitor the agency's efforts to implement this recommendation.

Recommendation: The Director of the Office of Management and Budget should require agencies to report in their quarterly inventory submissions those facilities previously reported as data centers, even if those facilities are not subject to the closure and optimization requirements of DCOI. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) has not yet taken action to address this recommendation. We will continue to monitor the agency's efforts to implement this recommendation.

Recommendation: The Director of the Office of Management and Budget should document OMB's decisions on whether to approve individual data centers when designated by agencies as either a mission critical facility or as a facility not subject to DCOI. (Recommendation 3)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) has not yet taken action to address this recommendation. We will continue to monitor the agency's efforts to implement this recommendation.

Recommendation: The Director of the Office of Management and Budget should take action to address the key performance measurement characteristics missing from the DCOI optimization metrics, as identified in this report. (Recommendation 4)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) has not yet taken action to address this recommendation. We will continue to monitor the agency's efforts to implement this recommendation.

Recommendation: The Secretary of Agriculture should take action to achieve its data center-related cost savings target established under DCOI by OMB. (Recommendation 5)

Agency: Department of Agriculture
Status: Open

Comments: In comments on our report, the Department of Agriculture (Agriculture) agreed with our recommendation and stated that it planned to meet the cost savings target in 2020. We will continue to monitor Agriculture's efforts to implement this recommendation.

Recommendation: The Secretary of Commerce should take action to achieve its data center-related cost savings target established under DCOI by OMB. (Recommendation 6)

Agency: Department of Commerce: Office of the Secretary
Status: Open

Comments: In comments on our report, the Department of Commerce (Commerce) agreed with our recommendation and described actions that they planned to take in order to address the recommendation. We will continue to monitor Commerce's efforts to implement this recommendation.

Recommendation: The Secretary of Commerce should take action to meet its data center optimization metric targets established under DCOI by OMB. (Recommendation 7)

Agency: Department of Commerce: Office of the Secretary
Status: Open

Comments: In comments on our report, the Department of Commerce (Commerce) agreed with our recommendation and described actions that they planned to take in order to address the recommendation. We will continue to monitor Commerce's efforts to implement this recommendation.

Recommendation: The Administrator of the National Aeronautics and Space Administration should take action to achieve its data center-related cost savings target established under DCOI by OMB. (Recommendation 8)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: In comments on our report, the National Aeronautics and Space Administration (NASA) agreed with our recommendation and described actions that the agency planned to take to address the recommendation. NASA stated that it expected to complete these actions by March 31, 2020. Once we have obtained and assessed evidence of the agency's actions taken, we will update the status of this recommendation.

Recommendation: The Director of BLM should develop a plan to conduct all required facility security assessments agency-wide, taking into consideration the agency's organizational structure, available resources, and training needs. (Recommendation 1)

Agency: Department of the Interior: Bureau of Land Management
Status: Open

Comments: BLM agreed with our recommendation and stated it intends to revise its policy and develop a plan to complete required facility security assessments. As of November 2019, BLM had not yet completed its plan.

Recommendation: The Director of the Park Service should develop a plan to conduct all required facility security assessments agency-wide, taking into consideration the agency's organizational structure, available resources, and training needs. (Recommendation 3)

Agency: Department of the Interior: National Park Service
Status: Open

Comments: Park Service agreed with our recommendation and cited its efforts to develop a plan that includes training and tools so that park unit staff can conduct the required assessments. As of November 2019, Park Service had not yet completed its plan.

Recommendation: The Director of the Park Service should update the agency's facility security assessment methodology to comply with requirements in the ISC Standard, including a step to consider the consequence of each undesirable event. (Recommendation 4)

Agency: Department of the Interior: National Park Service
Status: Open

Comments: Park Service agreed with our recommendation to update its facility security assessment methodology to comply with requirements in the ISC Standard. As of November 2019, Park Service had not yet updated its methodology.

Recommendation: The Director of BLM should develop a facility security assessment methodology that complies with requirements in the ISC Standard to assess all undesirable events and consider all three factors of risk for each undesirable event. (Recommendation 5)

Agency: Department of the Interior: Bureau of Land Management
Status: Open

Comments: BLM agreed with our recommendation and said it would revise its policy and develop a facility security assessment methodology that complies with requirements in the ISC Standard. As of November 2019, BLM had not yet developed its methodology.

Recommendation: The Director of FWS should develop a facility security assessment methodology that complies with requirements in the ISC Standard to assess all undesirable events and consider all three factors of risk for each undesirable event. (Recommendation 6)

Agency: Department of the Interior: United States Fish and Wildlife Service
Status: Open

Comments: FWS agreed with our recommendation and cited its efforts to develop a facility security assessment methodology that complies with requirements in the ISC Standard. As of November 2019, FWS had not yet developed its methodology.

Recommendation: The Chairman of NRC should direct NRC staff to consider socioeconomic consequences and fatalities from evacuations in the criteria for determining what security measures should be required for radioactive materials that could be used in an RDD. (Recommendation 1)

Agency: Nuclear Regulatory Commission
Status: Open
Priority recommendation

Comments: NRC disagreed with this recommendation, and NRC did not provide us with documentation of any actions it plans to take to implement this recommendation. NRC maintains that the current regulatory requirements provide for the safe and secure use of all radioactive materials, regardless of category. We disagree with NRC's assessment. We continue to believe that by implementing our recommendation NRC would have better assurance that it was considering more likely and more significant consequences of an RDD when establishing its security requirements for this material. We encourage NRC to take action to implement this recommendation.

Recommendation: The Chairman of NRC should require additional security measures for high-risk quantities of certain category 3 radioactive material, and assess whether other category 3 materials should also be safeguarded with additional security measures. (Recommendation 2)

Agency: Nuclear Regulatory Commission
Status: Open
Priority recommendation

Comments: NRC neither explicitly agreed nor disagreed with this recommendation, but stated that it would consider our recommendation as part of a working group the agency has established. The working group provided a staff analysis on these issues to the Commission in August 2017, but NRC has not updated this analysis taking into account the new information we provided in our April 2019 report. We continue to believe that implementing our recommendation would provide greater assurance that NRC's requirements are sufficient to help ensure all high-risk radioactive material are protected from theft and use in an RDD. We encourage NRC to take action to implement this recommendation.

Recommendation: The Chairman of NRC should require all licensees to implement additional security measures when they have multiple quantities of category 3 americium-241 at a single facility that in total reach a category 1 or 2 quantity of material. (Recommendation 3)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: NRC disagreed with this recommendation. NRC maintains that the issue of aggregation of radioactive material has already been considered and NRC has taken or is in the process of taking actions to clarify relevant guidance and procedures. We disagree with NRC's assessment. We believe that by implementing our recommendation NRC would have better assurance that licensees are not storing multiple quantities of category 3 americium-241 at a single facility that in total reach a category 1 or 2 quantity of material.

Recommendation: The TSA Administrator should direct the Security Policy and Industry Engagement's Surface Division to clarify TSA's Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: As of June 2020, TSA reported that it completed a review of the Pipeline Security Guideline criteria for determining critical facilities. TSA sought and received pipeline stakeholder comments following their review of the criteria. According to TSA officials, TSA is sharing draft criteria with federal stakeholders and anticipates completion of the review by December 31, 2020. We will continue to monitor the status of TSA's activities to determine whether our recommendation is fully implemented.

Recommendation: The TSA Administrator should develop a strategic workforce plan for its Security Policy and Industry Engagement's Surface Division, which could include determining the number of personnel necessary to meet the goals set for its Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct Corporate Security Reviews (CSR) and Critical Facility Security Reviews (CFSR). (Recommendation 3)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open
Priority recommendation

Comments: As of June 2020, TSA reported that officials, including TSA's Office of Human Capital Strategic Planning, began collaborating to draft a strategic workforce plan for the pipeline security section of TSA. According to the officials, while this effort was delayed as TSA's Office of Human Capital needed focus on protecting TSA's workforce in response to the COVID-19 public health emergency, progress has been made. Phase one of a four-phase process began the week of 6/8/2020, with a Manpower Study to be completed by October 2020. The second phase will be a job skills/competency analysis and the third and fourth phases are position management and classification, and plan development and approval, respectively. TSA estimated completion of the workforce plan by June 30, 2021. We will continue to monitor the status of these efforts to develop a strategic workforce plan in response to this recommendation.

Recommendation: The TSA Administrator should direct the Security Policy and Industry Engagement's Surface Division to identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the National Infrastructure Protection Plan and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies. (Recommendation 6)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: As of June 2020, TSA officials reported meeting with representatives from the Department of Homeland Security (DHS) and the Federal Emergency Management Agency (FEMA) in February and March 2019 for their input on the identification of sources relevant to threat, vulnerability, and consequence consistent with the National Infrastructure Protection Plan and DHS critical infrastructure risk mitigation priorities. TSA officials also reported meeting with RAND personnel in March 2020 to discuss possible contract options for addressing this recommendation. Further action on this recommendation has been limited due to work on the COVID-19 response. We will continue to monitor the status of TSA's activities to determine whether our recommendation is fully implemented.

Recommendation: The TSA Administrator should direct the Security Policy and Industry Engagement's Surface Division to take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach. (Recommendation 7)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: As of June 2020, DHS officials reported that TSA will take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool after addressing recommendations 4,5, and 6 of this report. DHS estimated that this effort would be completed by April 30, 2021.

Recommendation: The Secretary of the Army should direct the Army's Provost Marshal General to take actions to help ensure that physical security inspections at locations with Arms, Ammunition, and Explosives (AA&E) are conducted on time, as required by Army guidance. (Recommendation 1)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Navy should direct the Chief of Naval Operations' Supply, Ordnance, and Logistics Operations Division to take actions to help ensure that physical security inspections at locations with AA&E are conducted on time, as required by Navy guidance. (Recommendation 2)

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Navy should direct the Marine Corps Deputy Commandant for Plans, Policies, and Operations to take actions to help ensure that physical security inspections at locations with AA&E are conducted on time, as required by Marine Corps guidance. (Recommendation 3)

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Air Force should direct the Air Force's Office of the Deputy Chief of Staff for Logistics, Engineering and Force Protection, Directorate of Security Forces, to take actions to help ensure that inspectors at locations with AA&E are consistently documenting in inspection reports that all minimum requirements for physical security were checked. (Recommendation 4)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should direct the Under Secretary of Defense for Intelligence to revise DOD guidance to require that the military services establish a process to consistently document the resolution of all identified physical security deficiencies. (Recommendation 5)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretaries of Defense and of Transportation should address ADS-B Out security concerns by approving one or more solutions that address ADS-B Out -related security risks or incorporating mitigations for security risks into the existing draft memorandum of agreement. These approved solutions should address operations, physical, cyber-attack, and electronic warfare security risks; and risks associated with divesting secondary-surveillance radars. The solution or mitigations should be approved as soon as possible in order to allow sufficient time for implementation.

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with this recommendation. As of August 2018, DOD and the FAA signed a memorandum of agreement that that establishes a framework for DOD and FAA to jointly address the provision to allow certain aircraft not to broadcast and airspace monitoring and defense security issues related to ADS-B, and identifies a path to fully address the recommendations in our report. The memorandum of agreement was a first step to address the security issues we highlighted in the report; however, FAA still needs to publish a National Procedural Guidance for accommodation of DOD needs for mixed-equipment operations and operational security concerns (expected December 2018).

Recommendation: The Secretaries of Defense and of Transportation should address ADS-B Out security concerns by approving one or more solutions that address ADS-B Out -related security risks or incorporating mitigations for security risks into the existing draft memorandum of agreement. These approved solutions should address operations, physical, cyber-attack, and electronic warfare security risks; and risks associated with divesting secondary-surveillance radars. The solution or mitigations should be approved as soon as possible in order to allow sufficient time for implementation.

Agency: Department of Transportation
Status: Open

Comments: DOT concurred with this recommendation. As of August 2018, DOD and the FAA signed a memorandum of agreement that that establishes a framework for DOD and FAA to jointly address the provision to allow certain aircraft not to broadcast and airspace monitoring and defense security issues related to ADS-B, and identifies a path to fully address the recommendations in our report.

Recommendation: The Secretary of Defense should direct DOD components to implement key tasks that would facilitate consistent, long-term planning and implementation of NextGen--such as those tasks that the Deputy Secretary of Defense originally directed in 2007, or any tasks that the Secretary deems appropriate based on a current assessment of the original tasks.

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with this recommendation. As of August 2018, DOD has not taken action regarding the eight tasks GAO identified in the 2007 Deputy Secretary of Defense memorandum on ADS-B implementation.

Recommendation: The Under Secretary of Defense for Intelligence, in coordination with the DOD Chief Information Officer, the Under Secretaries of Defense for Policy; Acquisition, Technology, and Logistics; and Personnel and Readiness; and with military service and agency stakeholders, should conduct operations security surveys that identify IoT security risks and protect DOD information and operations, in accordance with DOD guidance, or address operations security risks posed by IoT devices through other DOD risk assessments.

Agency: Department of Defense: Office of the Under Secretary of Defense for Intelligence
Status: Open

Comments: DOD concurred with this recommendation. We reached out to DOD in August 2018 on this recommendation and are awaiting their response.

Recommendation: The Principal Cyber Advisor, in coordination with the DOD Chief Information Officer; the Under Secretaries of Defense for Policy; Intelligence; Acquisition, Technology, and Logistics; and Personnel and Readiness; and with military service and agency stakeholders, should (1) review and assess existing departmental security policies and guidance--on cybersecurity, operations security, physical security, and information security--that may affect IoT devices; and (2) identify areas where new DOD policies and guidance may be needed--including for specific IoT devices, applications, or procedures--and where existing security policies and guidance can be updated to address IoT security concerns.

Agency: Department of Defense: Office of the Principal Cyber Advisor to the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. DOD has implemented one geo-location policy in 2018 relating to operations security that addresses a portion of this recommendation.