States must follow numerous cybersecurity requirements when using federal data. These requirements may vary by federal agency. State information security officials we surveyed told us, among other things, that the differing requirements cost states additional time and money, and could ultimately detract from security efforts. Among the 4 federal agencies we examined, 49% to 79% of security requi...

In 2018, the administration released its government-wide reform plan aimed at making the federal government more efficient and effective. The Office of Management and Budget oversees the proposals with support from other lead agencies. We reviewed 5 reform proposals, including addressing the cybersecurity workforce shortage and establishing a Government Effectiveness Advanced Research Center. Pla...

“Cyber hygiene” is a set of practices for managing the most common and pervasive cybersecurity risks. The Department of Defense’s cyber hygiene is critical as threats to its information and networks increase. DOD has had 3 cyber hygiene initiatives underway. These efforts are incomplete—or their status is unknown because no one is in charge of reporting on progress. DOD has also develope...

The Federal Communications Commission uses the Electronic Comment Filing System to receive public comments about proposed regulation changes. In May 2017, a surge of more than 22 million comments disrupted the system making it unavailable. We issued a September 2019 report with 136 recommendations for improvements in this and other FCC systems. The report was not publically released because it co...

The Office of Management and Budget has been working with federal agencies to reduce the number of outdated or duplicative federal data centers. In fiscal year 2019, agencies closed 102 centers, and planned to close 184 more. OMB also narrowed the definition of a data center, recategorizing about 2,000 facilities and excluding them from federal reporting requirements. But many of these facilities...

Q: How does the government help keep banks, water systems, and other critical infrastructure from getting hacked? A: A federal agency that issues standards and procedures—NIST—has a cybersecurity framework that critical infrastructure organizations can adopt. All 12 organizations in our review were voluntarily using the framework, and told us they’ve seen benefits. For example, one organiz...

The Office of Congressional Workplace Rights enforces fair employment and occupational safety and health rules in the legislative branch. Congress passed a 2018 law that, among other things, required the office to create a secure online system for discrimination and harassment claims. We found weaknesses in the office’s project planning, system oversight, and cybersecurity risk management. For...

Federal agencies are increasingly using cloud computing services. Cloud computing offers benefits but also poses cybersecurity risks. OMB requires agencies to use the Federal Risk and Authorization Management Program to authorize their use of cloud services. Although agencies increased their program use—authorizations were up 137% from 2017 to 2019—15 of the 24 agencies we surveyed reported t...

A 2014 law requires federal agencies to have information security programs. The Office of Management and Budget oversees these efforts. We looked at how agencies and OMB have implemented the law and found: Of our sample of 16 agencies, most had weaknesses in most security control areas Inspectors General reported ineffective programs at 18 of 24 major agencies OMB coordinated cybersecurity revi...

Seven designated agencies--the Departments of Homeland Security, Justice, Defense, Commerce, Energy, and the Treasury, and the Office of the Director of National Intelligence--developed government-wide policies, procedures, and guidelines to assist federal and nonfederal entities in their efforts to receive and share cybersecurity information. In particular, these policies, procedures, and guideli...