U.S. cybersecurity R&D needs a master plan

United States doesn't have prioritized national cybersecurity research and development agenda, GAO says

The federal government’s cybersecurity research and development programs lack needed leadership and coordination, according to government auditors.

According to the Government Accountability Office, the government doesn’t have a prioritized national cybersecurity research and development agenda. Officials also don't have the ability to track all active and completed cybersecurity programs and a process to sufficiently share key information between government and industry, auditors wrote in a report released today.

“Without a current national cybersecurity R&D agenda, the nation is at risk that agencies and private sector companies may focus on their individual priorities, which may not be the most important national research priorities,” auditors wrote.

GAO said although the White House’s Office of Science and Technology Policy (OSTP) and its multi-agency coordination body named the Subcommittee on Networking and Information Technology Research and Development (NITRD) have recently tried to improve coordination, key problems remain. The lack of a national agenda makes it more likely that programs won’t reflect national priorities, important decisions will be postponed, and agencies will lack overall direction, GAO said.


Related stories

National Cybersecurity Initiative R&D effort launched

A House insider's view of U.S. cybersecurity policy


To fix the problems, the auditors recommended that the head of OSTP and the White House’s cybersecurity coordinator direct NITRD to:

  • Develop a comprehensive national R&D agenda that contains priorities for short-term, mid-term, and long-term complex cybersecurity R&D, input from industry and academia, and is consistent with an updated national cybersecurity strategy.
  • Tell the cybersecurity coordinator about shortages in the cybersecurity field so that information can be used to update the national cybersecurity strategy to correct personnel weaknesses.
  • Work with Office of Management and Budget to develop a way to keep track of all ongoing and completed federal cybersecurity R&D projects and their funding.
  • Use that new tracking mechanism to develop an ongoing process to make federal R&D information available to agencies and industry.

Officials from OMB and OSTP said they believe an agenda is contained in existing documents, according to GAO. However, the auditors said the documents are either outdated or lack appropriate detail.

In response, the science office wrote, “While [OSTP] cannot concur with certain of the findings in [the report], current OSTP actions and plans are in line with GAO’s Recommendations for Executive Action and [OSTP] can fully support these recommendations.”

 

About the Author

Ben Bain is a reporter for Federal Computer Week.

Featured

  • IT Modernization
    Eisenhower Executive Office Building (Image: Wikimedia Commons)

    OMB's user guide to the MGT Act

    The Office of Management and Budget is working on a rules-of-the-road document to cover how agencies can seek and use funds under the MGT Act.

  • global network (Pushish Images/Shutterstock.com)

    As others see us -- a few surprises

    A recent dinner with civil servants from Asia delivered some interesting insights, Steve Kelman writes.

  • FCW Perspectives
    cloud (Singkham/Shutterstock.com)

    A smarter approach to cloud

    Advances in cloud technology are shifting the focus toward choosing the right tool for the job and crafting solutions that truly modernize systems.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.