DHS' critical infrastructure plan not cyber-secure, GAO says

GAO says critical industrial sectors' plans don't deal with cybersecuity requirements

The Homeland Security Department should reconsider its approach for securing critical infrastructure after a recent review found most of the protective plans developed by agencies to work with different industries haven’t been updated to meet DHS’ cybersecurity requirements, according to the Government Accountability Office.

GAO investigators found that just three of 17 plans to secure critical infrastructure have been updated to include key cybersecurity criteria, according to a report released Oct. 28. Under DHS’ National Infrastructure Protection Plan, designated government agencies and departments be the lead agencies for collaborating with specific industrial sectors and are responsible for developing the protection plans.

According to GAO, only the water, chemical and commercial facilities industrial sector plans had been updated to include the cybersecurity requirements, while others -- such as information technology, telecommunications, nuclear plants and the defense industrial base -- had not.

DHS agreed with GAO’s overall recommendation to review the current approach and said it “supports the ongoing assessment and improvement of the sector planning approach.” However, the department said there were errors, misinterpretations and incorrect conclusions included in the report.

For example, DHS said the report didn’t take into account the many cybersecurity-related activities in various different sectors. DHS also said just because all of the plans hadn’t been fully updated didn’t mean cybersecurity planning and activities in the sectors were lacking. The department also said updates to the plans for 2010 would deal with the cyber requirements.

However, GAO said until the new sector plans are issued, it is unclear if they actually will deal with the cybersecurity requirements. In addition, GAO said agencies haven’t reported on how much progress they made in putting their plans in place, thus making it unclear how the different sectors were putting in place protective measures.

Meanwhile, DHS said sector specific plans are strategic three-year plans and not meant to provide snapshots of agency efforts or to assess progress in protecting critical infrastructure.

GAO said DHS hadn’t made sector planning a priority. “It is essential that federal cybersecurity leaders — including DHS and the to-be-appointed cybersecurity coordinator — exert their leadership roles in this area by, among other things, determining whether it is worthwhile to continue with the current approach as implemented or consider if proposed options provide more effective results,” the report said.

DHS also disputed GAO's assertion that it hadn’t made the sector planning process a priority and said it was actively engaged with the lead agencies and the industrial sector. 


About the Author

Ben Bain is a reporter for Federal Computer Week.


  • Congress
    U.S. Capitol (Photo by M DOGAN / Shutterstock)

    Funding bill clears Congress, heads for president's desk

    The $1.3 trillion spending package passed the House of Representatives on March 22 and the Senate in the early hours of March 23. President Trump is expected to sign the bill, securing government funding for the remainder of fiscal year 2018.

  • 2018 Fed 100

    The 2018 Federal 100

    This year's Fed 100 winners show just how much committed and talented individuals can accomplish in federal IT. Read their profiles to learn more!

  • Census
    How tech can save money for 2020 census

    Trump campaign taps census question as a fund-raising tool

    A fundraising email for the Trump-Pence reelection campaign is trying to get supporters behind a controversial change to the census -- asking respondents whether or not they are U.S. citizens.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.