High-Risk Series: Federal Government Needs to Urgently Pursue Critical Actions to Address Major Cybersecurity Challenges

Mar 24, 2021 08:00 pm Cyber Security 218

What GAO Found

GAO reiterates the importance of addressing the four major cybersecurity challenges and the 10 associated critical actions listed below.

Four Major Cybersecurity Challenges and 10 Associated Critical Actions

As described below, although the federal government has made selected improvements, it needs to move with a greater sense of urgency commensurate with the rapidly evolving and grave threats to the country.

Establishing a comprehensive cybersecurity strategy and performing effective oversight. The prior administration's September 2018 national cybersecurity strategy and the June 2019 implementation plan detail the executive branch's approach to managing the nation's cybersecurity. In September 2020 GAO reported that the national strategy and implementation plan addressed some, but not all, of the desirable characteristics of national strategies, such as goals and resources needed. The new administration needs to either update the existing strategy and plan or develop a new comprehensive strategy that addresses those characteristics.

GAO also highlighted the urgent need to clearly define a central role for leading the implementation of the national strategy. Accordingly, it recommended that the Congress consider legislation to designate a position in the White House to lead such an effort. In January 2021, the Congress did so by establishing the Office of the National Cyber Director within the Executive Office of the President. Once the position is filled, the federal government will be better situated to direct activities to overcome the nation's cyber threats and challenges, and to perform effective oversight.

Although establishing the Cyber Director position is an essential step forward, critical risks remain on supply chains, workforce management, and emerging technologies. For example, in December 2020, GAO reported that none of the 23 agencies in its review had fully implemented key foundational practices for managing information and communications technology ..

Support the originator by clicking the read the rest link below.