Cyber Security

While CISA intended to fully implement the transformation by December 2020, it had completed 37 of 94 planned tasks for phase three by mid-February 2021. Among the tasks not yet completed, 42 of them were past their most recent planned completion dates. Included in these 42 are the tasks of finalizing the mission-essential functions of CISA's divisions and issuing a memorandum defining incident management roles and responsibilities across CISA. Tasks such as these appear to be critical to CISA's transformation initiative and accordingly its ability to effectively and efficiently carry out its cyber protection mission. In addition, the agency had not established an updated overall deadline for completing its transformation initiative. Until it establishes updated milestones and an overall deadline for its efforts, and expeditiously carries out these plans, CISA will be hindered in meeting the goals of its organizational transformation initiative.

Establishing agency cybersecurity incident response teams and describing their responsibilities for responding to cybersecurity incidents, including breaches of personal information containing confidential or exempt data. To address the threats posed on our nation’s cybersecurity defenses, the Federal Government must continue to advance technical and policy protection capabilities for national systems. We must also expand partnerships with the private sector and work with Congress to clarify roles and responsibilities. To do this, GAO reviewed relevant information on CISA's efforts to develop an organizational transformation initiative to meet the requirements of the CISA Act of 2018. To assess the progress of CISA's efforts, GAO analyzed agency documentation to determine the status of activities related to the three phases of the organizational transformation and reasons for any delays in its progress.

Most of the cybercrime investigations that the Secret Service and Immigration and Customs Enforcement-Homeland Security Investigations pursue every day also include a transnational dimension that requires cooperation with law enforcement partners around the globe. The second sprint focuses on building a more robust and a more diverse cybersecurity workforce. DHS cannot tackle ransomware and the broader Agency Cybersecurity cybersecurity challenges without talented and dedicated people who can help protect the Nation's schools, hospitals, critical infrastructure, and communities. This sprint focused on leveraging the Office of the Secretary to elevate the fight against ransomware, an increasingly devastating and costly form of malicious cyber activity that targets organizations of all sizes and across all sectors.

NSA Cybersecurity prevents and eradicates threats to U.S. national security systems with a focus on the Defense Industrial Base and the improvement of U.S. weapons’ security. Bridget Beans leads the Integrated Operations Division for the Cybersecurity and Infrastructure Security Agency . IOD focuses integrated operations across the Agency extending to Regional CISA elements, intelligence, operational planning and mission execution with focus on risk mitigation and response efforts. Brandon Wales is the first Executive Director of the Cybersecurity and Infrastructure Security Agency , serving as the senior career executive overseeing execution of the Director and Deputy Director’s vision for CISA operations and mission support. He is responsible for leading long-term strategy development, managing CISA-wide policy initiatives and ensuring effective operational collaboration across the Agency. We look at the entire threat picture and work with partners across government and industry to defend against today’s threats while securing the nation’s critical infrastructure against threats that are just over the horizon.

Ms. Easterly was nominated by President Biden in April 2021 and unanimously confirmed by the Senate on July 12, 2021. As Director, Ms. Easterly leads CISA’s efforts to understand, manage, and reduce risk to the cyber and physical infrastructure Americans rely on every day. CISA works with partners to defend against today’s threats and collaborates to build a more secure and resilient infrastructure for the future. Using a standard risk assessment methodology that includes the identification of an agency’s priorities, constraints, risk tolerances, and assumptions necessary to support operational risk decisions. Federal Risk and Authorization Management Program - Standardized government approach to security assessment, authorization, and continuous monitoring for cloud products and services.