This testimony discusses our work on information technology challenges at the Department of Veterans Affairs. Despite spending over $4 billion annually on IT: VA still doesn't have IT systems that fully support critical services—e.g., veterans health care, the Family Caregiver Program, and disability benefits.Some VA IT management processes do not effectively implement federal IT acquisition law...

The federal government has spent billions on information technology projects that have failed or performed poorly. Some agencies have had massive cybersecurity failures. These IT efforts often suffered from ineffective management. We testified about 2 issues on our High Risk List: 1) IT acquisitions and operations management and 2) cybersecurity. Since 2010, agencies have implemented 64% of our 1,...

In providing health care and other benefits to veterans, the VA relies extensively on its IT systems and networks to maintain sensitive data—such as veterans’ medical records. However, we testified that the VA (like many other federal agencies) continues to face several IT security challenges as it secures and modernizes its systems. These challenges include: Effectively safeguarding its se...

This testimony focuses on the Federal Trade Commission's authority to oversee Internet privacy and security. Without a comprehensive federal data privacy law, the United States relies in part on FTC to use its broad authority to protect consumers from unfair and deceptive trade practices. Most industry representatives we interviewed favored the current approach and warned that further regulations...

The federal government has spent billions on information technology projects that failed or have performed poorly. These efforts often suffered from ineffective management. Agencies have also had cybersecurity failures affecting millions of people. This testimony addresses 2 issues we identified as high risk for the federal government: management of IT acquisitions and operations, and cybersecuri...

GAO has identified four major cybersecurity challenges and 10 critical actions that the federal government and other entities need to take to address them. GAO continues to designate information security as a government-wide high-risk area due to increasing cyber-based threats and the persistent nature of security vulnerabilities.Ten Critical Actions Needed to Address Four Major Cybersecurity Chal...

Reliance on a global supply chain introduces multiple risks to federal information systems. Supply chain threats are present during the various phases of an information system's development life cycle and could create an unacceptable risk to federal agencies. Information technology (IT) supply chain-related threats are varied and can include:installation of intentionally harmful hardware or softwa...

In recent years, the Department of Homeland Security (DHS) has acted to improve and promote the cybersecurity of federal and private-sector computer systems and networks, but further improvements are needed. Specifically, consistent with its statutory authorities, DHS has made important progress in implementing programs and activities that are intended to mitigate cybersecurity risks on the comput...

The Department of Homeland Security (DHS) has taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014 ; however, its actions have not been timely and complete. For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cyberse...

In its draft report, GAO noted that several governmentwide initiatives aimed at eliminating the unnecessary collection, use, and display of Social Security numbers (SSN) have been underway in response to recommendations that the presidentially appointed Identity Theft Task Force made in 2007 to the Office of Personnel Management (OPM), the Office of Management and Budget (OMB), and the Social Secu...