Modern commercial airplanes use avionics systems and networks to share data—for GPS, weather, and communications—with pilots, maintenance crews, other aircraft, and air traffic controllers. Protection from cyberattacks is critical to safety. Airplane manufacturers have cybersecurity controls in place and there haven't been reports of successful cyberattacks on commercial airplane IT systems to...

The U.S. and its allies face expanding foreign cyber threats as international trade, communication, and critical infrastructure grow increasingly dependent on cyberspace. In 2019, the State Department said it would establish a Bureau of Cyberspace Security and Emerging Technologies to focus on the issue. State works with other federal agencies on international cyber issues. However, it has not inf...

Increasingly sophisticated threats underscore the need to bolster the cybersecurity of the nation—a topic on our High Risk List. We and others have noted an urgent need to clearly define a central leadership role to coordinate government efforts. Despite the issuance of a National Cyber Strategy in 2018, it is still unclear which executive branch official is ultimately responsible for not only c...

The Department of Housing and Urban Development collects huge amounts of sensitive personal information for its housing, community investment, and mortgage loan programs. HUD often shares this information with affiliated agencies; contractors; and state, local, and tribal groups. HUD isn't taking enough action to protect information exchanged with others. The agency expects external entities to ha...

The financial services sector, a critical component of the nation's infrastructure that holds over $108 trillion in assets, is an increasingly attractive target for cyber-based attacks. The sector includes banks, mutual funds, and securities dealers The Treasury Department and other federal agencies are taking steps to reduce risks and bolster the sector's efforts to improve its cybersecurity. We...

This testimony discusses our work on information technology challenges at the Department of Veterans Affairs. Despite spending over $4 billion annually on IT: VA still doesn't have IT systems that fully support critical services—e.g., veterans health care, the Family Caregiver Program, and disability benefits.Some VA IT management processes do not effectively implement federal IT acquisition law...

Schools and school districts collect and store a lot of personal information about their students. But are K-12 institutions adequately securing student data? We found: Thousands of K-12 students had their personal information compromised in data breaches between 2016 and 2020Compromised data included grades, bullying reports, and Social Security numbers—leaving students vulnerable to emotional,...

DHS gives agencies cybersecurity tools that identify the hardware and software on their networks and check for vulnerabilities and insecure configurations. We reviewed how 3 agencies—the Federal Aviation Administration, Indian Health Service, and the Small Business Administration—used these tools. These agencies' hardware inventories were missing information and contained duplicates. For examp...

The federal government has spent billions on information technology projects that have failed or performed poorly. Some agencies have had massive cybersecurity failures. These IT efforts often suffered from ineffective management. We testified about 2 issues on our High Risk List: 1) IT acquisitions and operations management and 2) cybersecurity. Since 2010, agencies have implemented 64% of our 1,...

States must follow numerous cybersecurity requirements when using federal data. These requirements may vary by federal agency. State information security officials we surveyed told us, among other things, that the differing requirements cost states additional time and money, and could ultimately detract from security efforts. Among the 4 federal agencies we examined, 49% to 79% of security requi...