DHS gives agencies cybersecurity tools that identify the hardware and software on their networks and check for vulnerabilities and insecure configurations. We reviewed how 3 agencies—the Federal Aviation Administration, Indian Health Service, and the Small Business Administration—used these tools. These agencies' hardware inventories were missing information and contained duplicates. For examp...

Federal agencies are increasingly using cloud computing services. Cloud computing offers benefits but also poses cybersecurity risks. OMB requires agencies to use the Federal Risk and Authorization Management Program to authorize their use of cloud services. Although agencies increased their program use—authorizations were up 137% from 2017 to 2019—15 of the 24 agencies we surveyed reported t...

As required by the Federal Cybersecurity Workforce Assessment Act of 2015 (act), the Office of Personnel Management (OPM) developed a cybersecurity coding structure under the National Initiative for Cybersecurity Education (NICE) as well as procedures for assigning codes to federal civilian cybersecurity positions. However, OPM issued the coding structure and procedures 5 and 4 months later than t...

Pursuant to a congressional request, GAO reviewed the Small Business Administration's (SBA) management of information technology (IT), focusing on the five key IT process areas--investment management, architecture, information security, software development and acquisition, and human capital management.GAO noted that: (1) although SBA plans to improve its key IT processes, many of SBA's policies a...

GAO reviewed the way the Department of Housing and Urban Development (HUD) organized and defined its systems of records to compare how HUD and two other selected agencies have organized their systems of records, provide a breakdown of the HUD accounting records system, identify the reasons HUD reported fewer systems than any other cabinet level department, and provide a breakdown of the changes in...