Modern commercial airplanes use avionics systems and networks to share data—for GPS, weather, and communications—with pilots, maintenance crews, other aircraft, and air traffic controllers. Protection from cyberattacks is critical to safety. Airplane manufacturers have cybersecurity controls in place and there haven't been reports of successful cyberattacks on commercial airplane IT systems to...

The U.S. and its allies face expanding foreign cyber threats as international trade, communication, and critical infrastructure grow increasingly dependent on cyberspace. In 2019, the State Department said it would establish a Bureau of Cyberspace Security and Emerging Technologies to focus on the issue. State works with other federal agencies on international cyber issues. However, it has not inf...

Increasingly sophisticated threats underscore the need to bolster the cybersecurity of the nation—a topic on our High Risk List. We and others have noted an urgent need to clearly define a central leadership role to coordinate government efforts. Despite the issuance of a National Cyber Strategy in 2018, it is still unclear which executive branch official is ultimately responsible for not only c...

The Department of Housing and Urban Development collects huge amounts of sensitive personal information for its housing, community investment, and mortgage loan programs. HUD often shares this information with affiliated agencies; contractors; and state, local, and tribal groups. HUD isn't taking enough action to protect information exchanged with others. The agency expects external entities to ha...

The financial services sector, a critical component of the nation's infrastructure that holds over $108 trillion in assets, is an increasingly attractive target for cyber-based attacks. The sector includes banks, mutual funds, and securities dealers The Treasury Department and other federal agencies are taking steps to reduce risks and bolster the sector's efforts to improve its cybersecurity. We...

Schools and school districts collect and store a lot of personal information about their students. But are K-12 institutions adequately securing student data? We found: Thousands of K-12 students had their personal information compromised in data breaches between 2016 and 2020Compromised data included grades, bullying reports, and Social Security numbers—leaving students vulnerable to emotional,...

DHS gives agencies cybersecurity tools that identify the hardware and software on their networks and check for vulnerabilities and insecure configurations. We reviewed how 3 agencies—the Federal Aviation Administration, Indian Health Service, and the Small Business Administration—used these tools. These agencies' hardware inventories were missing information and contained duplicates. For examp...

States must follow numerous cybersecurity requirements when using federal data. These requirements may vary by federal agency. State information security officials we surveyed told us, among other things, that the differing requirements cost states additional time and money, and could ultimately detract from security efforts. Among the 4 federal agencies we examined, 49% to 79% of security requi...

Terrorists and others may pose a cyber-threat to high-risk chemical facilities. Control systems, for example, could be manipulated to release hazardous chemicals. The Department of Homeland Security started a program more than a decade ago to help address these security risks. We reviewed the program. DHS guidance designed to help about 3,300 facilities comply with cybersecurity and other standar...

The Internal Revenue Service must keep its computer systems secure to protect financial and taxpayer data. Every year since FY 1997, we have assessed whether the IRS had effective controls in place to safeguard this information. During this year’s audit, we identified new and continuing deficiencies in information system security controls. These deficiencies affect IRS’s ability to help ensur...