Cybersecurity still 'high risk' in GAO’s book after over 25 years

The Government Accountability Office released its biennial list of government operations considered high risk on Thursday.

Cybersecurity is on the list, as it has been since 1997. Comptroller General Gene Dodaro told lawmakers Thursday that, “The federal government is still not operating at a pace commensurate with the evolving threat.”

There are over 850 open recommendations from GAO related to cybersecurity – which Dodaro called out as an area needing significant attention – that haven’t been implemented, including 52 of 133 recommendations deemed high priority for agency and department heads by GAO.

Cybersecurity is one of 34 areas considered to be high risk. The list also includes other tech-related areas. NASA has improved its acquisition management, for example, but still has work to do, as do the departments of Defense, Veterans Affairs and Energy. 

The Department of Homeland Security’s IT and Financial Management and DOD business systems modernization are also called out on the list.

In terms of cybersecurity, the White House released a new national cybersecurity strategy in March. 

But Dodaro emphasized the importance of the forthcoming implementation plan promised by the administration, listing off unanswered questions – “Who's responsible for what? How much money do we need? How are we going to measure performance and improvements in those areas?”

Other cybersecurity challenges delineated in the report include “fully developing” privacy management programs in agencies and securing the government’s own systems and those of critical infrastructure sectors.

“I don't think the federal government really knows the preparedness of many of these important sectors of our economy as much as they should, in terms of the electricity grid, the communications networks, the financial markets and many other areas,” said Dodaro of critical infrastructure cybersecurity. “There needs to be much more partnership between the federal government and the private sector in this area.”

GAO witnesses also talked with lawmakers about shortages in the cybersecurity workforce, something the White House’s Office of the National Cyber Director is working on a plan to address.

The management of the government’s IT acquisitions and operations has also been on the list for eight years, although GAO noted that OMB and agencies have actually made progress on implementing these recommendations since the last update, with 73% fully implemented.

Still, “this is kind of a vexing problem,” said Dodaro. “A lot of these systems weren't built with security and so it's complicating our ability [in the] cybersecurity area. The cost is expensive. There are efforts to try to replace them, but they often fail because of lack of discipline [and] IT management issues.”

GAO says that 15 federal agencies haven’t implemented recommendations around the role and authorities of their chief information officers, although there have been improvements in “aligning the CIO with agency leadership,” said Nick Marinos, managing director of GAO’s IT and cybersecurity team. That gives them “the ability to see across a federal agency where IT dollars are being spent,” he said.

Planning around the tech workforce and modernizing or replacing legacy systems are also areas that have open recommendations, and there’s also an unrealized push from GAO for Congress to formalize the federal CIO position.

“Having a strong federal CIO presence would allow that individual to bring federal agencies to the table… to know not only are they spending money wisely, but if there are opportunities to leverage that buying power,” said Marinos. “And then the other side of it is ultimately to hold CIOs accountable and federal agency heads accountable towards those CIOs as well.”

Sixteen high risk areas total saw improvements since 2021, said Dodaro. Two topics – the 2020 Decennial Census and the Pension Benefit Guaranty Corporation – were removed from the list completely, and one added – management of the federal prison system. 

GAO also added the Department of Health and Human Services’ leadership and coordination during health emergencies, as well as the unemployment system to the list in 2022.

In terms of what it takes to make progress, Dodaro wrote in his testimony that, “it has typically involved three essential elements: congressional action or oversight, commitment from top leaders at agencies and active involvement by the Office of Management and Budget.”