Despite congressional mandates and presidential orders, most federal agencies are still behind in implementing standards and frameworks for securing their networks, the Government Accountability Office (GAO) says in a new report.
"The 23 civilian agencies covered by the Chief Financial Officers Act of 1990 have often not effectively implemented the federal government's approach and strategy for securing information systems," says the report. "Until agencies more effectively implement the government's approach and strategy, federal systems will remain at risk."
The Federal Information Security Modernization Act of 2014 directs federal agencies to develop and implement plans to secure their networks. In 2017, President Trump issued an executive order requiring agencies to implement the National Institute of Standards and Technology Cybersecurity Framework that outlines best practices for assessing risk to information systems and ways to strengthen cyber security.
GAO mentions that the Department of Homeland Security's Continuous Diagnostics and Mitigation (CDM) program, which is designed for departments and agencies to acquire cyber security services and tools to help protect their networks, is behind schedule and that most agencies still say they need more "training and guidance." It also says that most agencies haven't implemented the CDM tools and services available in the first two phases of the program.
The report also says that some agencies haven't moved to protect certain attack vectors.
"For example, 21 of 23 agencies had not, as of September 2018, sufficiently enhanced email protection through implementation of DHS' directive on enhanced email security," says the report, Information Security: Agencies Need to Improve Implementation of Federal Approach to Securing Systems and Protecting against Intrusions (GAO-19-105). "In addition, less than half of the agencies that use cloud services reported monitoring these services."