In 2018, the administration released its government-wide reform plan aimed at making the federal government more efficient and effective. The Office of Management and Budget oversees the proposals with support from other lead agencies. We reviewed 5 reform proposals, including addressing the cybersecurity workforce shortage and establishing a Government Effectiveness Advanced Research Center. Pla...

“Cyber hygiene” is a set of practices for managing the most common and pervasive cybersecurity risks. The Department of Defense’s cyber hygiene is critical as threats to its information and networks increase. DOD has had 3 cyber hygiene initiatives underway. These efforts are incomplete—or their status is unknown because no one is in charge of reporting on progress. DOD has also develope...

A 5G wireless network will move data faster: potentially 20 times faster than 4G. But it isn’t just for phones—it’s expected to facilitate tech that will transform industries and maybe people’s lives. By using more of the radio frequency spectrum, along with many other upgrades, 5G will support massive numbers of devices and provide near-instant network responses—enabling technologies l...

Data breaches have exposed the personal data of hundreds of millions of people and put them at risk for identity theft. We looked at what you can do if you're a victim of a data breach. Identity theft services can be convenient, but they don't prevent fraud from happening in the first place. There are also some steps you can take on your own for free—such as freezing your credit reports. A fre...

The federal government needs a qualified, well-trained cybersecurity workforce to protect vital IT systems. Not having enough of these workers is one reason why securing federal systems is on our High Risk list. To help agencies identify their critical workforce needs, they were required to identify and categorize all of their IT and cyber-related positions. However, most of the agencies we revi...

The Office of Personnel Management (OPM) has made progress in implementing GAO's recommendations, but further efforts remain. As of September 20, 2018, OPM had implemented 51 (about 64 percent) of the 80 recommendations, but had not provided any evidence, or provided insufficient evidence, to demonstrate implementation of the remaining recommendations, as shown in table 1.Table 1: OPM’s Implemen...

The Department of Homeland Security (DHS) has taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014 ; however, its actions have not been timely and complete. For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cyberse...

Since the 2015 data breaches, the Office of Personnel Management (OPM) has taken actions to prevent, mitigate, and respond to data breaches involving sensitive personal and background investigation information, but actions are not complete. OPM implemented or made progress towards implementing 19 recommendations made by the United States Computer Emergency Readiness Team (US-CERT) to bolster OPM's...

GAO and others have identified a number of key challenges facing federal agencies in ensuring that they have an effective cybersecurity workforce:Identifying skills gaps: As GAO reported in 2011, 2015, and 2016, federal agencies have faced challenges in effectively implementing workforce planning processes for information technology (IT) and defining cybersecurity staffing needs. GAO also reporte...

Identity theft services offer some benefits but have limitations.Credit monitoring helps detect new-account fraud (that is, the opening of new unauthorized accounts) by alerting users, but it does not prevent such fraud or address existing-account fraud, such as misuse of a stolen credit card number. Consumers have alternatives to credit monitoring, including requesting a low-cost credit freeze,...