Information Security: Significant Progress Made, but CDC Needs to Take Further Action to Resolve Control Deficiencies and Improve Its Program

CDC is responsible for detecting and responding to emerging health threats and controlling dangerous substances. In carrying out its mission, CDC relies on information technology systems to receive, process, and maintain sensitive data. Accordingly, effective information security controls are essential to ensure that the agency's systems and information are protected from misuse and modification.

GAO was asked to examine information security at CDC. In June 2018, GAO issued a limited official use only report on the extent to which CDC had effectively implemented technical controls and an information security program to protect the confidentiality, integrity, and availability of its information on selected information systems.

This current report is a public version of the June 2018 report. In addition, for this public report, GAO determined the extent to which CDC has taken corrective actions to address the previously identified security program and technical control deficiencies and related recommendations for improvement. For this report, GAO reviewed supporting documents regarding CDC's actions on previously identified recommendations and interviewed personnel at CDC.

As GAO reported in June 2018, the Centers for Disease Control and Prevention (CDC) implemented technical controls and an information security program that were intended to safeguard the confidentiality, integrity, and availability of its information systems and information. However, GAO identified control and program deficiencies in the core security functions related to identifying risk, protecting systems from threats and vulnerabilities, detecting and responding to cyber security events, and recovering system operations (see table below). GAO made 195 recommendations to address these deficiencies.

As of August 2018, CDC had made significant progress in resolving many of the security deficiencies by implementing 102 of 184 (about 55 percent) technical control recommendations, and partially implementing 1 of 11 information security program recommendations made in the June 2018 report. The figure shows the status of CDC's efforts to implement the 195 recommendations.

Additionally, CDC has created remedial action plans to implement the majority of the remaining open recommendations by September 2019. Until CDC implements these recommendations and resolves the associated deficiencies, its information systems and information will remain at increased risk of misuse, improper disclosure or modification, and destruction.

The Centers for Disease Control and Prevention (CDC) is responsible for  protecting America from both foreign and domestic health, safety, and  security threats. Its roles include detecting and responding to new and  emerging health threats, tackling the biggest health problems causing  death and disability for Americans, putting science and advanced  technology into action to prevent disease, and controlling dangerous and  exotic substances that can cause incurable and deadly diseases.  Performing these roles may involve tracking diseases and finding out  what is making people sick and the most effective ways to prevent  diseases.

CDC confronts global disease threats through advanced computing and  laboratory analysis of large amounts of data to find solutions, making use  of computer systems critical to the process. However, cyber incidents at  federal agencies demonstrate the damage that increasingly sophisticated  threats can cause and underscore the importance of effectively protecting  federal systems, including those used by CDC to achieve its mission.

Since 1997, we have designated the security of information on federal  systems (i.e., information security) to be a government-wide high-risk  area. In 2003, we expanded the area to include securing the  computerized systems supporting the nation’s critical infrastructure and,  in 2015, we included protecting the privacy of personally identifiable  information.

Given the critical role that CDC performs and concerns over the security  of federal information systems, you requested that we examine the  security controls over key CDC systems. Accordingly, our specific  objective was to assess the extent to which CDC had effectively  implemented an information security program and controls to protect the  confidentiality, integrity, and availability of its information on selected  information systems.

In June 2018, we issued a report that addressed the extent to which CDC  had effectively implemented an information security program and controls  to protect the confidentiality, integrity, and availability of its information on  selected information systems. In the report, we made 184  recommendations to CDC to resolve the technical security control  deficiencies in the information systems we reviewed and 11 additional  recommendations to improve its information security program. We  designated that report as “limited official use only” (LOUO) and did not  release it to the general public because of the sensitive information it  contained.

This subsequent report publishes the findings discussed in our June 2018  report, but we have removed all references to the sensitive information.  Specifically, we deleted the names of the information systems and  computer networks that we examined, disassociated identified control  deficiencies from named systems, deleted certain details about  information security controls and control deficiencies, and omitted an  appendix that was contained in the LOUO report. The appendix contained  sensitive details about the technical security control deficiencies in CDC’s  information systems and computer networks that we reviewed, and the  184 recommendations we made to mitigate those deficiencies. We also  provided a draft of this report to CDC officials to review and comment on  the sensitivity of the information contained herein and to affirm that the  report can be made available to the public without jeopardizing the  security of CDC’s information systems and networks.

In addition, this report addresses a second objective that was not  included in the June 2018 report. Specifically, this objective was to  determine the extent to which CDC has taken corrective actions to  address the previously identified security program and technical control  deficiencies and related recommendations for improvement that we  identified in the earlier report.

As noted in our LOUO report, to accomplish the first objective—to  determine the extent to which CDC had effectively implemented an  information security program and controls—we had examined the  agency’s security policies, procedures, and practices, and evaluated the  technical security controls over 24 CDC systems. These included 10 key  systems, 8 of which were mission-essential, that (1) collect, process, and  maintain private or potentially sensitive proprietary business, medical, and  personally identifiable information; (2) are essential to CDC’s mission; (3)  could have a catastrophic or severe impact on operations if compromised;  or (4) could be of particular interest to potential adversaries. We also  selected 14 general support systems that were part of the network  infrastructure supporting the 10 systems.

To review CDC’s information security program, we had examined security  policies, procedures, and other documents; analyzed risk assessments,  security plans, security control assessments, remedial action plans, and  contingency plans for 8 selected mission-essential systems; and  interviewed personnel at CDC headquarters. To review controls over the  10 key systems and 14 general support systems, we had examined the  agency’s network infrastructure and assessed the controls associated  with system access, encryption, configuration management, and logging  and monitoring. We conducted site visits to two CDC facilities located in  Atlanta, Georgia.

To accomplish our second objective—on CDC’s actions to address the  previously identified security program and technical control deficiencies  and related recommendations—we requested that the agency provide a  status report of its actions to implement each recommendation we made  in the June 2018 report. For each recommendation that CDC indicated it  had implemented as of August 3, 2018, we examined supporting  documents, observed or tested the associated security control or  procedure, and/or interviewed the responsible agency officials to assess  the effectiveness of the actions taken to implement the recommendation  or otherwise resolve the underlying control deficiency. Based on this  assessment and CDC status reports, we categorized the status of each  recommendation as being closed-implemented, open-partially  implemented, or open-not implemented. Additional details on our  objectives, scope, and methodology are provided in appendix I.

We conducted this performance audit from December 2016 to December  2018 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

CDC—an operating division of the Department of Health and Human  Services (HHS)—serves as the national focal point for disease prevention  and control, environmental health, and promotion and education activities  designed to improve the health of Americans. The agency is also  responsible for leading national efforts to detect, respond to, and prevent  illnesses and injuries that result from natural causes or the release of  biological, chemical, or radiological agents.

To achieve its mission and goals, the agency relies on an array of  partners, including public health associations and state and local public  health agencies. It collaborates with these partners on initiatives such as  monitoring the public’s health, investigating disease outbreaks, and  implementing prevention strategies. The agency also uses its staff  located in foreign countries to aid in international efforts, such as guarding  against global diseases. Table 1 describes the organization of CDC.

CDC is staffed by approximately 20,000 employees across the United  States and around the world. For fiscal year 2017, according to agency  officials, the agency’s total appropriation was approximately $12 billion, of  which it reported spending approximately $424 million on information  technology. In addition, the officials stated that approximately $31 million  (or about 7.3 percent of the amount spent on information technology) was  for information security across all CDC information technology  investments.

CDC Relies on Information Systems to Help Achieve Its Mission

CDC relies extensively on information technology to fulfill its mission and  support related administrative needs. Among the approximately 750  systems reported in its inventory, the agency has systems dedicated to  supporting public health science, practice, and administration. All of these  systems rely on an information technology infrastructure that includes  network components, critical servers, and data centers.

CDC Has Defined Organizational Security Roles and Responsibilities

At CDC, the chief information officer (CIO) is responsible for establishing  and enforcing policies and procedures protecting information resources.  The CIO is to lead the efforts to protect the confidentiality, integrity, and  availability of the information and systems that support the agency and its  operations, and is to report quarterly to the HHS CIO on the overall  effectiveness of CDC’s information security and privacy program,  including the progress of remedial actions.

The CIO designated a chief information security officer (CISO), who is to  oversee compliance with applicable information security and privacy  requirements of the agency. The CISO, among other things, is  responsible for providing information security protections commensurate  with the risk and magnitude of the harm resulting from unauthorized  access, use, disclosure, and disruption of information and information  systems that support the operations and assets of the agency.

To further ensure information security compliance, information systems  security officers (ISSO) are responsible for managing the information  security program within their respective organizations and report on  security program matters to the CISO, including computer security-related  incidents. ISSO responsibilities include ensuring that vendor-issued  security patches are expeditiously installed and that system owners  establish processes for timely removal of access privileges when a user’s  system access is no longer necessary. In addition, security stewards are  to perform operational security analyses supporting the efforts of the  ISSO. Further, business stewards serve as program managers, accepting  full accountability for the operations of the systems and ensuring that  security is planned, documented, and properly resourced for each aspect  of the information security program.

Federal Laws and Guidance Establish Security Requirements to Protect Federal Information and Systems

The Federal Information Security Modernization Act (FISMA) of 2014  provides a comprehensive framework for ensuring the effectiveness of  information security controls over information resources that support  federal operations and assets. FISMA assigns responsibility to the head  of each agency for providing information security protections  commensurate with the risk and magnitude of the harm resulting from  unauthorized access, use, disclosure, disruption, modification, or  destruction of information systems used or operated by an agency or by a  contractor of an agency or other organization on behalf of an agency. The  law also delegates to the agency CIO (or comparable official) the  authority to ensure compliance with FISMA requirements. The CIO is  responsible for designating a senior agency information security officer  whose primary duty is information security.

The law also requires each agency to develop, document, and implement  an agency-wide information security program to provide risk-based  protections for the information and information systems that support the  operations and assets of the agency. In addition, FISMA requires  agencies to comply with National Institute of Standards and Technology  (NIST) standards, and the Office of Management and Budget (OMB)  requires agencies to comply with NIST guidelines.

NIST Federal Information Processing Standards (FIPS) Publication 199  requires agencies to categorize systems based on an assessment of the  potential impact that a loss of confidentiality, integrity, or availability of  such information or information system would have on organizational  operations, organizational assets, individuals, other organizations, and  the nation. NIST FIPS 200 requires agencies to meet minimum security  requirements by selecting the appropriate security controls, as described  in NIST Special Publication (SP) 800-53. This NIST publication provides  a catalog of security and privacy controls for federal information systems  and a process for selecting controls to protect organizational operations  and assets. The publication provides baseline security controls for low-,  moderate-, and high-impact systems, and agencies have the ability to  tailor or supplement their security requirements and policies based on  agency mission, business requirements, and operating environment.

Further, in May 2017, the President issued an executive order requiring  agencies to immediately begin using NIST’s Cybersecurity Framework  for managing their cybersecurity risks. The framework, which provides  guidance for cybersecurity activities, is based on five core security  functions:  Identify: Develop the organizational understanding to manage  cybersecurity risk to systems, assets, data, and capabilities.

Protect: Develop and implement the appropriate safeguards to  ensure delivery of critical infrastructure services.

Detect: Develop and implement the appropriate activities to identify  the occurrence of a cybersecurity event.

Respond: Develop and implement the appropriate activities to take  action regarding a detected cybersecurity event.

Recover: Develop and implement the appropriate activities to  maintain plans for resilience and to restore any capabilities or services  that were impaired due to a cybersecurity event.

According to NIST, these 5 functions occur concurrently and  continuously, and provide a strategic view of the life cycle of an  organization’s management of cybersecurity risk. Within the 5 functions  are 23 categories and 108 subcategories that include controls for  achieving the intent of each function. Appendix II provides a description  of the framework categories and subcategories of controls.

Security Control Deficiencies Placed Selected CDC Systems at Risk

We reported in June 2018 that CDC had implemented numerous controls  over the 24 systems we reviewed, but had not always effectively  implemented controls to protect the confidentiality, integrity, and  availability of these systems and the information maintained on them.  Deficiencies existed in the technical controls and agency-wide  information security program that were intended to (1) identify risk, (2)  protect systems from threats and vulnerabilities, (3) detect cybersecurity  events, (4) respond to these events, and (5) recover system operations.

These deficiencies increased the risk that sensitive personally identifiable  and health-related information, including information regarding the  transfer of biological agents and toxins dangerous to public health, could  be disclosed or modified without authorization. As shown in table 2,  deficiencies existed in all 5 core security function areas for the selected  systems we reviewed.

CDC Had Identified Risk and Developed Policies and Plans, but Shortcomings Existed

Controls associated with the identify core security function are intended to  help an agency develop an understanding of its resources and related  cybersecurity risks to its systems, assets, data, and capabilities. These  controls include identifying and assessing cybersecurity risk and  establishing information security policies, procedures, and plans. We  reported in June 2018 that, although CDC had taken steps to implement  these controls, it had not (1) categorized the risk-related impact of a key  system, identified threats, or reassessed risk for systems or facilities  when needed; (2) sufficiently documented technical requirements in  policies, procedures, and standards; and (3) described intended controls  in facility security plans.

CDC Did Not Appropriately Categorize at Least One Key System, but Assessed Risk to Some Extent at System and Entity-wide Levels

CDC Categorized Systems Based on Potential Impact of  Compromise, but Did Not Appropriately Categorize a Key General  Support System  As discussed earlier, FIPS Publication 199 requires agencies to  categorize systems based on an assessment of the potential impact that  a loss of confidentiality, integrity, or availability of such information or  information system would have on organizational operations,  organizational assets, individuals, other organizations, and the nation. For  networks and other general support systems, NIST SP 800-60 notes  that the categorization should be based on the high water mark of  supported information systems, and on the information types processed,  transmitted across the network, or stored on the network or support  system. Further, CDC’s architecture design principles state that high- impact systems are to be maintained on dedicated machinery and be  physically and logically secured from lower-risk systems.

CDC had categorized the 24 systems we reviewed, but the assigned  impact level was not always appropriate. In this regard, the agency did  not ensure that high-impact systems were logically secured from a lower- risk system. Specifically, seven selected high-impact systems relied on a  general support system that the agency had categorized as a moderate- impact system (i.e., a lower-risk system). As a result, the high-impact  systems were relying on controls in a less secure environment. Officials  from the Office of the Chief Information Officer (OCIO) explained that the  categorization of the supporting system was outdated based on changes  to the agency’s operating environment and that they planned to re- evaluate the assigned impact level.

CDC Assessed Risk at the System Level, but Did Not Assess  Threats, Document Risk-based Decisions, or Reassess Risk When  Needed  According to NIST SP 800-30, risk is determined by identifying potential  threats to an organization and vulnerabilities in its systems, determining  the likelihood that a particular threat may exploit vulnerabilities, and  assessing the resulting impact on the organization’s mission, including  the effect on sensitive and critical systems and data. NIST also states that  assessments should be monitored on an ongoing basis to keep current  on risk-impacting changes to the operating environment.

CDC had developed system-level risk assessments for the 8 selected  mission-essential systems, and had summarized its risks in a risk  assessment report. However, only two of the eight risk assessments had  identified potential threats, and only one of these assessments  determined the likelihood and impact of threats to that system.

Further, CDC had not always documented risks associated with less  secure configuration settings or monitored its assessments to address  changes to the operating environment. For example, among the 94  technical control deficiencies that we identified for the 24 systems we  reviewed, OCIO officials stated that the agency had not implemented  controls for 20 deficiencies due to technical constraints. However, CDC  did not address risks associated with decisions not to implement controls  for these reasons in the system risk assessments.

OCIO officials also partially attributed 5 of the 94 technical control  deficiencies to new cybersecurity threats and to threat vectors that turned  initially sound architecture decisions into vulnerabilities. However, CDC  had not addressed such changes in the risk assessments for the affected  systems. By not assessing threats or the likelihood of their occurrence  and impact and by not documenting the risks, CDC cannot have  assurance that appropriate controls are in place commensurate with the  level of risk.

CDC Had a Process in Place to Assess Risk to Systems from an  Entity-wide Perspective  Beyond the system level, newly discovered threats or vulnerabilities may  require an agency to make risk decisions from an entity-wide perspective.  An entity-wide perspective is needed because the threats and  vulnerabilities may affect more than specific systems.

CDC had a process in place to assess risk from an entity-wide  perspective. This process included regular meetings among OCIO and  program office staff to discuss policy, threats, and incidents. Specifically,  ISSOs held monthly meetings as a continuous monitoring working group  to discuss policy updates. In addition, an OCIO official held quarterly  briefings that included presentations on incident response tools, incident  statistics, and potential threats. OCIO officials also held ad hoc meetings,  as necessary, regarding vulnerability and threat concerns when the  agency received email alerts from the Federal Bureau of Investigation,  the Department of Homeland Security (DHS), or HHS.

CDC Had Not Updated Facility Risk Assessments  In addition to assessing risks for systems, agencies are to assess the risk  to their facilities. The Interagency Security Committee (ISC) requires  agencies to determine the security level for federal facilities, and to  conduct risk assessments at least once every 5 years for Level I and  Level II facilities and at least once every 3 years for Level III, Level IV,  and Level V facilities.

However, the two facility risk assessments that we reviewed had not been  updated in a timely manner. Specifically, the risk assessments, covering  Level III and Level IV facilities that house the 24 reviewed systems, had  been last updated in January 2009 and March 2014—8 years earlier and  just over 3 years earlier, at the time of our review in July 2017.

According to a CDC physical security official, the agency had previously  relied on a third-party assessor to perform the assessments. The official  also said that the agency planned to conduct its own facility risk  assessments and had recently developed procedures for conducting  these assessments. Until it performs these assessments, CDC may not  be aware of new risks to its facilities or the controls needed to mitigate the  risks.

CDC Had Documented Controls in Policies, Procedures, and Standards, but Had Not Included Certain Technical Requirements

FISMA requires each agency to develop, document, and implement an  information security program that, among other things, includes policies  and procedures that (1) are based on a risk assessment, (2) cost- effectively reduce information security risks to an acceptable level, (3)  ensure that information security is addressed throughout the life cycle of  each system, and (4) ensure compliance with applicable requirements.  According to NIST SP 800-53, an agency should develop policies and  procedures for each of the 18 NIST families of security controls to  facilitate the implementation of the controls.

CDC had documented numerous policies, procedures, and standards that  addressed each of the 18 control families identified in NIST SP 800-53.  For example, the agency had developed policies and procedures  governing physical access to CDC facilities, role-based training of  personnel with significant security responsibilities, security assessment  and authorization of systems, and continuity of operations, in addition to  standard operating procedures that covered numerous other controls.

The agency had also developed the CDC IT Security Program  Implementation Standards, which describes the agency’s security  program requirements and minimum mandatory standards for the  implementation of information security and privacy controls. In addition,  the agency had documented configuration standards, which specified  minimum configuration settings, for devices such as firewalls, routers,  switches, as well as Unix and Windows servers.

However, these policies and standards sometimes lacked the technical  specificity needed to ensure controls were in place. To illustrate, the  agency had not sufficiently documented detailed guidance or instructions  to address numerous technical control deficiencies we identified, such as  insecure network devices, insecure database configurations, not blocking  certain email attachments, and not deploying a data loss prevention  capability.

According to OCIO officials, the agency’s periodic reviews and updates to  existing cybersecurity policies and standards did not reveal and address  these issues. Nevertheless, without clear and specific guidance or  instructions for implementing technical controls, the agency had less  assurance that controls were in place and operating as intended.

CDC Had Identified and Updated Controls in System Security Plans Annually, but Had Not Developed Facility Security Plans

FISMA requires each agency to develop, document, and implement an  information security program that, among other things, includes  subordinate plans for providing adequate information security for  networks, facilities, and systems or a group of information systems, as  appropriate. NIST states that plans should be reviewed and updated to  ensure that they continue to reflect the correct information about the  systems, such as changes in system owners, interconnections, and  authorization status, among other things.

HHS and CDC policies require that such plans be reviewed annually. In  addition, the ISC requires that agencies develop and implement an  operable and effective facility security plan. CDC standards require the  organization to prepare a facility security plan (or similar document).

CDC had developed security plans for the 8 selected mission-essential  systems. With a few exceptions, the plans addressed the applicable  security controls for those systems. The agency also had reviewed and  updated the plans annually.

However, CDC had not developed security plans for the facilities housing  resources for the selected systems. Physical security officials stated that  they had not developed security plans because they did not have a  sufficient number of staff to develop them. Without comprehensive  security plans for the facilities, CDC’s information and systems would be  at an increased risk that controls to address emergency situations would  not be in place and personnel at the facilities would not be aware of their  roles and responsibilities for implementing sound security practices to  protect systems housed at these CDC locations.

CDC Had Implemented Controls Intended to Protect Its Systems, but Deficiencies Existed

The protect core security function is intended to help agencies develop  and implement the appropriate safeguards for their systems to ensure  achieving the agency’s mission and to support the ability to limit or  contain the impact of a potential cybersecurity event. Controls associated  with this function include implementing controls to limit access to  authorized users, processes or devices; encrypting data to protect its  confidentiality and integrity; configuring devices securely and updating  software to protect systems from known vulnerabilities; and providing  training for cybersecurity awareness and performing security-related  duties. Although CDC had implemented controls that were intended to  protect its operating environment, we reported in June 2018 that the  agency did not consistently (1) implement access controls effectively, (2)  encrypt sensitive data, (3) configure devices securely or apply patches in  a timely manner, or (4) ensure staff with significant security  responsibilities received role-based training.

CDC Did Not Consistently Implement Effective Access Controls

A basic management objective for any agency is to protect the resources  that support its critical operations from unauthorized access. Agencies  accomplish this objective by designing and implementing controls that are  intended to prevent, limit, and detect unauthorized access to computing  resources, programs, information, and facilities. Access controls include  those related to identifying and authenticating users, authorizing access  needed to perform job duties, protecting system boundaries, and  physically protecting information system assets. However, CDC had not  consistently implemented these controls.

CDC Implemented Enterprise-wide Identification and Authentication  Controls, but Did Not Consistently and Securely Configure  Password Controls for Certain Accounts on Devices and Systems  NIST SP 800-53 states that agencies should implement multi-factor  authentication for their users of information systems. Multi-factor  authentication involves using two or more factors to achieve  authentication. A factor is something you know (password or personal  identification number), something you have (token and personal identity  verification (PIV) card), or something you are (biometric). Also, NIST and  CDC policy state that information systems shall have password  management controls established to include minimum password  complexity requirements, password lifetime restrictions, prohibitions on  password reuse, and user accounts temporarily locked out after a certain  number of failed login attempts during a specified period of time.

CDC had applied enterprise-wide solutions to ensure appropriate  identification and multi-factor authentication of its general user community  through, for example, the use of PIV cards. However, instances of weak  password management controls existed for certain accounts on network  devices, servers, and database systems. According to OCIO officials,  password control deficiencies existed primarily due to technical  constraints, administrators not being aware of technical requirements, or  administrators not adequately monitoring configuration settings. Without  more secure password settings, CDC’s information and systems are at an  increased risk that unauthorized individuals could have guessed  passwords and used them to obtain unauthorized access to agency  systems and databases.

CDC Authorized Users More Access than Needed to Perform Their  Jobs  NIST SP 800-53 states that agencies should employ the principle of least  privilege, allowing only authorized access for users (or processes acting  on behalf of users) that are necessary to accomplish assigned tasks. It  also states that privileged accounts—those with elevated access  permissions—should be strictly controlled and used only for their intended  administrative purposes.

CDC had implemented controls intended to ensure that users were  granted the minimum level of access permissions necessary to perform  their legitimate job-related functions. However, the agency had granted  certain users more access than needed for their job functions, including  excessive access permissions on a key server.

According to OCIO officials, CDC systems had deficiencies related to  restricting access primarily due to technical constraints or administrators  not adequately monitoring configuration settings. By not appropriately  restricting access, CDC’s information and systems are at an increased  risk that individuals could deliberately or inadvertently compromise  database systems or gain inappropriate access to information resources.

CDC Did Not Effectively Implement Boundary Controls to Ensure  Network Integrity  NIST SP 800-53 states that agencies should control communications at  information systems’ external boundaries. It states that, to manage risks,  agencies should use boundary protection mechanisms to separate or  partition computing systems and network infrastructures containing  higher-risk systems from lower-risk systems.

Although CDC had implemented multiple controls that were designed to  protect system boundaries, the agency had not sufficiently separated  higher-risk systems from lower-risk systems. According to OCIO officials,  deficiencies in boundary protection controls existed due to new  cybersecurity threats turning initially sound architecture decisions into  vulnerabilities, technical constraints, and administrators not being aware  of technical requirements or adequately monitoring configuration settings.  Without stronger boundary controls, CDC’s information and systems are  at an increased risk that an attacker could have exploited these boundary  deficiencies and leveraged them to compromise CDC’s internal network.

CDC Physically Protected Information System Assets, but Did Not  Consistently Ensure Access Remained Appropriate  NIST SP 800-53 states that agencies should implement physical access  controls to protect employees and visitors, information systems, and the  facilities in which they are located. In addition, NIST states that agencies  should review access lists detailing authorized facility access by  individuals at the agency-defined frequency. In its standards, CDC  requires implementation of the NIST special publication and requires that  access lists detailing authorized facility access by individuals be reviewed  at least every 365 days.

CDC had implemented physical security controls. The agency had  implemented physical security measures to control access to certain  areas and to ensure the safety and security of its employees, contractors,  and visitors to CDC facilities. For example, CDC had issued PIV cards  and Cardkey Proximity Cards to its employees and contractors, and had  limited physical access to restricted areas based on the permissions it  granted via these cards.

However, the agency had not consistently reviewed authorized access  lists. In this regard, CDC did not have a process in place for periodically  reviewing the lists of individuals with access to rooms containing sensitive  resources to ensure that such access remained appropriate. Without  reviewing authorized access lists, CDC has reduced assurance that  individual access to its computing resources and sensitive information is  appropriate.

CDC Had Not Consistently Encrypted Sensitive Authentication Data

NIST SP 800-53 states that agencies should encrypt passwords both  while stored and transmitted, and configure information systems to  establish a trusted communication path between the user and the system.  Additionally, NIST requires that, when agencies use encryption, they use  an encryption algorithm that complies with FIPS 140-2.

CDC had used FIPS-compliant encryption for its PIV card  implementation, but had not effectively implemented encryption controls  in other areas. According to OCIO officials, encryption control deficiencies  existed primarily due to technical constraints, administrators not being  aware of a technical solution, or configuration settings not being  adequately monitored. By not using encryption effectively, CDC limits its  ability to protect the confidentiality of sensitive information, such as  passwords.

CDC Had Not Consistently Configured Servers Securely or Applied Patches in a Timely Manner

NIST SP 800-53 states that agencies should disable certain services with  known security vulnerabilities. This includes configuring security control  settings on operating systems in accordance with publicly available  security checklists (or benchmarks) promulgated by NIST’s National  Checklist Program repository. This repository contains, for example, the  security configuration benchmarks established by the Center for Internet  Security (CIS) for Windows servers.

NIST also states that agencies should test and install newly-released  security patches, service packs, and hot fixes in a timely manner. In  addition, CDC policy required that software patches for remediating  vulnerabilities designated as critical or high risk be applied to servers  within 45 days of being notified that a patch is available or within 7 days  of when an exploit is known to exist. Further, agency policy specified that  administrators configure Windows servers in accordance with the CDC- approved security benchmarks.

CDC had documented security configuration baselines, but had not  always securely configured its systems or applied patches. In addition,  the agency had not consistently configured security settings in  accordance with prescribed security benchmarks or applied patches in a  timely manner. For example:

CDC had configured Windows servers to run unnecessary services.

CDC had configured only about 62 percent of the security settings in  accordance with prescribed benchmark criteria on the Windows and  infrastructure servers supporting five systems that we reviewed.

During our site visit in April 2017, CDC had not installed 21 updates  on about 20 percent of the network devices, including 17 updates that  the vendor considered to be critical or high-risk. The oldest of the  missing updates dated back to January 2015.

CDC had not updated database software supporting two selected  systems to a more recent version that addressed vulnerabilities with a  medium severity rating.

According to OCIO officials, CDC had deficiencies in configuration and  patching primarily due to administrators not being aware that there was a  technical solution or did not adequately monitor configuration settings. By  not securely configuring devices and installing updates and patches in a  timely manner, the agency is at increased risk that individuals could have  exploited known vulnerabilities to gain unauthorized access to agency  computing resources.

Staff Received Security Awareness Training, but At Least 15 Percent of Those with Significant Security Responsibilities Did Not Receive Role-Based Training

According to NIST SP 800-53, agencies should provide adequate security  training to individuals in a role such as system/network administrator and  to personnel conducting configuration management and auditing  activities, tailoring the training to their specific roles. In addition, one of the  cybersecurity cross-agency priority goals requires that agencies  implement training that reduces the risk that individuals will introduce  malware through email and malicious or compromised web sites.

Consistent with NIST SP 800-53, CDC policy required network users to  receive annual security awareness training. Accordingly, for fiscal year  2017, all CDC staff completed the required annual security awareness  training.

CDC policy also required that those staff identified as having significant  security responsibilities receive role-based training every 3 years.  However, not all staff with significant security responsibilities received  role-based training within the defined time frames. The agency used a  tracking system to monitor the status of role-based training for 377  individuals who had been identified as having significant security  responsibilities. As of May 2017, 56 (about 15 percent) of the 377  individuals had not completed the training within the last 3 years, and 246  (about 65 percent) of them had not taken training within the last year.

In addition, CDC had not identified at least 30 other staff with significant  security responsibilities who required role-based training. Specifically,  none of the 18 security and database administrators for four selected  systems were included among the individuals being tracked, although  these administrators had significant security responsibilities. Further, the  agency provided us with a list of 42 individuals whose job series indicated  that they required role-based training. However, 12 of the 42 were not  included among the tracked individuals. Furthermore, given the number of  deficiencies identified and the rapidly evolving nature of cyber threats,  CDC’s requirement that staff take role-based training only once every 3  years is not sufficient for individuals with significant cybersecurity  responsibilities.

According to OCIO officials, managers are responsible for identifying  those individuals with significant security responsibilities. The process  used to track training was manual and required an individual’s manager to  specify training requirements. The officials noted that the agency plans to  implement a new HHS annual role-based training requirement in fiscal  year 2018 and that they intend to work to enhance oversight as the new  requirement is implemented.

The officials also stated that at least 10 of the 94 technical control-related  deficiencies identified in our June 2018 report had resulted, at least in  part, from staff not being aware of control requirements or solutions to  address the deficiencies. As a result, CDC’s information and systems are  at increased risk that staff may not have the knowledge or skills needed  to appropriately protect them.

CDC Had Not Effectively Implemented Controls Intended to Detect Incidents or Deficiencies

The detect core security function is intended to allow for the timely  discovery of cybersecurity events. Controls associated with this function  include logging and monitoring system activities and configurations,  assessing security controls in place, and implementing continuous  monitoring. In June 2018, we reported that, although CDC had  implemented controls intended to detect the occurrence of a  cybersecurity event, it had not sufficiently implemented logging and  monitoring capabilities or effectively assessed security controls.

CDC Had Implemented Limited Logging and Monitoring Capabilities

NIST SP 800-53 states that agencies should enable system logging  features and retain sufficient audit logs to support the investigations of  security incidents and the monitoring of select activities for significant  security-related events. In addition, National Archives and Records  Administration records retention guidance states that system files  containing information requiring special accountability that may be  needed for audit or investigative purposes should be retained for 6 years  after user accounts have been terminated or passwords altered, or when  an account is no longer needed for investigative or security purposes,  whichever is later. NIST also states that agencies should monitor  physical access to facilities where their information systems reside to  detect physical security incidents. Further, NIST SP 800-53 states that  agencies should monitor and control changes to configuration settings.

Although CDC had implemented centralized logging and network traffic  monitoring capabilities, the capabilities were limited. For example, the  agency’s centralized logging system used for security monitoring had a  limited storage capacity and did not meet the National Archives and  Records Administration requirements. In addition, CDC had not centrally  collected and monitored security event data for many key assets  connected to the network. As a result, increased risk existed that CDC  would not have been able to detect anomalous activities that may have  occurred from malware attacks over time. OCIO officials stated that, as a  compensating measure, the agency prevents direct communications  between workstations. However, such a measure does not allow the  agency to detect potentially inconsistent activities that may have occurred  from malware attacks within the same data center.

CDC also had not consistently reviewed physical access logs to detect  suspicious physical access activities, such as access outside of normal  work hours and repeated access to areas not normally accessed.  Program offices responsible for 7 of the 8 selected mission-essential  systems did not conduct such a review. According to OCIO officials, the  offices were not aware of the need for a review. However, without  reviewing physical access logs, CDC has reduced assurance that the  agency would detect suspicious physical access activities.

Further, CDC had not routinely monitored the configuration settings of its  systems to ensure that the configurations were securely set. For example,  for at least 41 of 94 technical control deficiencies we identified, OCIO  officials cited quality control gaps where the change management  process or system administrators had not discovered deficiencies  resulting from insecure configuration settings. Without an effective  monitoring process in place for system configurations, the agency was  not aware of insecure system configurations.

CDC Did Not Effectively Test or Assess Controls to Detect Deficiencies

FISMA requires each agency to periodically test and evaluate the  effectiveness of its information security policies, procedures, and  practices. The law also requires agencies to test the management,  operational, and technical controls for every system identified in the  agency’s required inventory of major information systems at a frequency  depending on risk, but no less than annually. In addition, NIST SP 800- 53A identifies three assessment methods—interview, examine, and test— and describes the potential depth and coverage for each. Assessing a  control’s effectiveness based on an interview is likely less rigorous than  examining a control; similarly, examining a control is likely less rigorous  than testing the control’s functionality.

CDC had not sufficiently tested or assessed the effectiveness of the  security controls for the 8 mission-essential systems that we reviewed.  Although CDC annually assessed security controls of selected systems,  the agency had only examined control descriptions in security plans to  ensure accuracy. At least once every 3 years, the agency selected  controls for a more in-depth assessment of the 8 mission-essential  systems we reviewed. However, CDC had assessed only 191 (about 7  percent) of 2,818 controls described in the security plans for the selected  systems. In addition, the agency used methods for assessing controls  that were often not rigorous enough to identify the control deficiencies  that we identified. For example, as depicted in figure 1, CDC relied  exclusively on interviews—a less rigorous method—to assess 20 percent  of the 191 controls it assessed for the selected systems.

The security control tests and assessments were insufficient in part  because CDC had not developed comprehensive security assessment  plans or had not consistently implemented the plans for the 8 selected  mission-essential systems we reviewed. For example, one system’s  assessment plan indicated that five controls should be assessed using a  testing methodology; instead, however, the assessor conducted  interviews to determine whether controls were effective or not.

OCIO officials stated that the security control test and assessment  process is manual and staffing is limited. They stated that the agency  intends to rely increasingly on automated tools—such as the tools  implemented by the Continuous Diagnostics and Mitigation program—for  performing the assessments. Nevertheless, by not assessing controls in  an in-depth and comprehensive manner, CDC has limited assurance that  the security controls are in place and operating as intended. Further,  without developing and implementing comprehensive assessment plans,  assessments may not be performed with sufficient rigor to identify control  deficiencies.

CDC Had Implemented Processes for Responding to Incidents or Identified Deficiencies, but Did Not Always Take Timely Corrective Actions

The respond core security function is intended to support the ability to  contain the impact of a potential cybersecurity event. Controls associated  with this function include implementing an incident response capability  and remediating newly-identified deficiencies. Although CDC had  implemented controls for incident response to detect cybersecurity  events, we reported in June 2018 that the agency had not maintained  adequate information to support its incident response capability or taken  timely corrective actions to remediate identified control deficiencies.

CDC Had Implemented Incident Response Capabilities, but Did Not Maintain Adequate Information

NIST SP 800-53 and SP 800-61 state that agencies should develop and  document an incident response policy with corresponding implementation  procedures and an incident response plan, and keep them updated  according to agency requirements. NIST also states that agencies should  implement an incident handling capability, including an incident response  team that consists of forensic/malicious code analysts. In addition,  agencies are to provide incident response training for the team and test  the incident response capability to determine the effectiveness of the  response.

Further, NIST states that agencies are to monitor incidents by tracking  and documenting them and maintain records about each incident,  including forensic analysis. Finally, National Archives and Records  Administration guidance states that records and data relevant to security  incident investigations should be retained for 3 years.

CDC had implemented an incident response capability. The agency had  developed policy, procedures, and a plan that addressed incident  response, and updated them annually. CDC had an incident response  team that managed all of the incident handling and response efforts for  the agency, and conducted forensic analyses for reported security  incidents. Team members had undergone training, such as an advanced  network forensic and analysis course offered by a private firm. In addition,  the agency had periodically tested its incident handling capability by  conducting penetration testing exercises. These exercises allowed the  team to test its real-time response capabilities.

CDC’s incident response procedures state that incident tickets should  include a description of actions taken, response time, and whether  actions have been completed or not. The agency’s procedures also  require that computers affected by an incident be removed from the  network immediately.

Nevertheless, CDC had shortcomings in implementing its incident  response capability and monitoring procedures. For the 11 security  incidents CDC considered most significant over a 19-month period ending  in March 2017, the agency had not consistently described the actions  taken, the response times, or whether remedial actions had been  completed. The agency also had not maintained audit log records for its  security incidents. For example, the agency described recommended  actions for 10 of the 11 incidents, but did not describe the actions that had  been taken.

In addition, although incident response team officials told us that all  incident ticket records had been saved, CDC had not retained system log  data that supported incident resolution for at least five of the incidents.  The agency’s policy did not address record retention in accordance with  National Archives and Records Administration guidance. Further, for two  of the security incidents, the security incident tickets did not clearly  indicate when two compromised workstations had been removed from the  network. According to OCIO officials, shortcomings in fully documenting  incidents resulted from the organization being understaffed, primarily due  to budget limitations and the inability to hire qualified personnel. Without  effectively tracking and documenting information system security  incidents, CDC’s systems are at increased risk that the impact of security  incidents would not be fully addressed.

CDC Had Remedial Action Plans to Address Identified Deficiencies for Selected Systems, but Did Not Always Take Timely Corrective Actions or Have Plans for Other Needed Corrective Actions

FISMA requires each agency to develop, document, and implement an  information security program that, among other things, includes a process  for planning, implementing, evaluating, and documenting remedial actions  to address any deficiencies in information security policies, procedures, or  practices. NIST SP 800-53 states that agencies are to develop a plan of  action and milestones (POA&M) for an information system to document  the agency’s planned remedial actions to correct identified deficiencies.  CDC policy was consistent with the NIST guidelines.

CDC had developed POA&Ms for deficiencies identified by its security  control assessments, but had not remediated the deficiencies in a timely  manner. For each of the 8 selected mission-essential systems, the  agency had created plans for correcting control deficiencies. However,  the agency did not implement several remedial actions by their due date.  For example, expected completion dates had passed for correcting  deficiencies associated with 4 of the 8 selected mission-essential  systems. For these 4 systems, the completion dates were 1 to 8 months  beyond the due dates at the time of our review in September 2017.

According to Office of the Chief Information Security Officer officials,  program offices that own the systems did not always communicate  updates on the status of remedial actions for their respective systems,  noting that deficiencies may have been corrected. Without effective  communication to update its POA&Ms, CDC was not in a position to  effectively manage its remedial actions and correct known deficiencies in  a timely manner.

CDC Had Developed and Tested Plans for System Recovery, but Had Not Assessed the Risk Associated with the Close Proximity of an Alternate Processing Site

The recover core security function is intended to support timely recovery  of normal operations to reduce the impact from a cybersecurity event.  Controls associated with this function include developing and testing  contingency plans to ensure that, when unexpected events occur, critical  operations can continue without interruption or can be promptly resumed,  and that information resources are protected. Losing the capability to  process, retrieve, and protect electronically maintained information can  significantly affect an agency’s ability to accomplish its mission. If  contingency planning is inadequate, even relatively minor interruptions  can result in lost or incorrectly processed data, which can cause financial  losses, expensive recovery efforts, and inaccurate or incomplete  information.

NIST SP 800-53 states that agency systems should have a contingency  plan that includes the identification of key personnel and the systems’  essential mission functions and addresses full information system  restoration. For high-impact systems, NIST specifies that agencies test  contingency plans at an alternate processing site that is separated from  the primary processing site to reduce susceptibility to the same threats. In  addition, NIST states that organizations should initiate corrective actions  based on testing if they are needed.

As we reported in June 2018, CDC had developed and fully tested  contingency plans for each of the 8 selected mission-essential systems  that we reviewed. Each plan identified key personnel and their contact  information, essential mission functions of the systems, and instructions  on how to fully restore the systems in the event of a disruption.  Additionally, between January 2015 and May 2017, CDC had tested  whether the 8 systems could be recovered at their respective alternate  sites, and had initiated corrective actions based on the results of the  tests.

However, the alternate site for 6 of the 8 selected mission-essential  systems was located in relatively close proximity to the main processing  site. Although 2 systems had alternate sites located in another state, the  alternate site for the other 6 systems was within the same metropolitan  area. As a result, an event such as a natural disaster or substantial power  outage could affect both the main and alternate sites for these systems,  potentially rendering CDC unable to complete functions associated with  its mission. Prompt restoration of service is necessary because the  required recovery time for these systems ranged from 4 to 24 hours.

Security plans for 3 of the systems recognized the hazards of having the  sites within the same geographical region, but stated that CDC had  accepted this risk. According to OCIO officials, having a site further away  was cost prohibitive; however, the officials had not documented this  analysis or the associated risk of having the agency’s processing sites  located within the same geographical area. Without documenting the  analysis and associated risk, CDC had less assurance that senior  leadership was aware of the risk of agency systems being unavailable. As  a consequence, senior leadership may not agree whether acceptance of  the risk was warranted.

CDC Had Not Consistently or Effectively Implemented Elements of Its Information Security Program

An underlying reason for the information security deficiencies in selected  systems was that, although the agency had developed and documented  an agency-wide information security program, it had not consistently or  effectively implemented elements of the program. FISMA requires each  agency to develop, document, and implement an information security  program that, among other things, includes the following elements: periodic assessments of the risk and magnitude of the harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems  that support the operations and assets of the agency; policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements; plans for providing adequate information security for networks,  facilities, and systems or group of information systems, as  appropriate;  security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies  and procedures, as well as training personnel with significant security  responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems; a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in the information  security policies, procedures, or practices of the agency; and plans and procedures to ensure continuity of operations for  information systems.

As discussed previously in this report, CDC had implemented aspects of  each of these elements. For example, the agency had conducted risk  assessments, developed security plans, assessed security controls,  developed remedial action plans, and developed and tested contingency  plans for each of the 8 selected mission-essential systems. In addition,  the agency had documented numerous policies and procedures and  ensured that staff had completed annual security awareness training.

However, CDC’s program had shortcomings. For example, as discussed  earlier in this report, CDC had not consistently or effectively: addressed threats, technical constraints, and the changing threat  environment in its system risk assessments, or assessed the risk of  having alternate processing sites within close proximity to each other; documented detailed technical requirements in policies and  procedures, or facility controls in facility security plans;  tracked and trained staff with significant security responsibilities; monitored configuration settings and comprehensively assessed  remediated deficiencies in a timely manner; or documented its cost analysis and associated risk of having an  alternate processing site within the same geographical region as its  primary processing site.

Until CDC addresses these shortcomings and consistently and effectively  implements all elements of its information security program, the agency  will lack reasonable assurance that its computing resources are protected  from inadvertent or deliberate misuse.

CDC Has Implemented Many of the Recommendations in Our June 2018 Report and Plans to Implement the Rest

In our June 2018 report, we made 195 recommendations to CDC to  strengthen its technical security controls and bolster its agency-wide  information security program. Specifically, we recommended that the  agency take 184 actions to resolve technical control deficiencies by  implementing stronger access controls, encrypting sensitive data,  configuring devices securely, applying patches in a timely manner,  strengthening firewall rules, and implementing logging and monitoring  controls more effectively, among other actions. We also made 11  recommendations for CDC to improve its information security program by,  among other things, assessing risks as needed, documenting more  detailed technical requirements, monitoring and assessing controls more  comprehensively, and remediating deficiencies in a timely manner.

Since the issuance of our June 2018 report, CDC has made significant  progress in implementing the recommendations we made to resolve the  technical security control deficiencies in the information systems we  reviewed and to improve its information security program. In this regard,  the agency has implemented many of the recommendations for improving  technical security controls for the systems we reviewed and has  developed plans to implement recommendations for enhancing its  information security program.

Specifically, as of August 3, 2018, CDC had fully implemented 102 (55  percent) of the 184 recommendations we made to fortify the technical  security controls over the systems we reviewed. In addition, the agency  had partially implemented 20 (11 percent) of the 184 recommendations.  In these instances, CDC had made progress toward implementing the  recommendations, but had not completed all of the necessary corrective  actions for us to close the recommendations. Therefore, these  recommendations remain open. Further, CDC did not provide any  evidence that it had implemented the remaining 62 technical control- related recommendations.

Table 3 summarizes the status of CDC’s efforts to implement the 184  recommendations that we made to resolve the technical control  deficiencies, as of August 3, 2018.

By implementing 102 recommendations, CDC (as of August 3, 2018)  reduced some of the risks associated with certain key activities.  Specifically, these efforts included protecting network boundaries and  logging and monitoring security events for indications of inappropriate or  unusual activity on systems—that we highlighted in our June 2018 report  as being particularly vulnerable and requiring the agency’s greater priority  and attention. In addition, the agency had implemented several of our  recommendations to rectify a number of the security control deficiencies.  These efforts included strengthening firewall rules, implementing stronger  access controls, configuring devices securely, and expanding its audit  monitoring capabilities.

In addition, CDC had developed a plan of action and milestones  (POA&M) for each of the identified technical control deficiencies and  related recommendations that remained open as of August 3, 2018. The  POA&Ms assigned organization responsibilities, identified estimated  costs, identified points of contact, and established time frames for  resolving the deficiencies and closing the related recommendations. The  agency’s plans called for it to implement the majority of the remaining  open technical control-related recommendations by September 2019, and  all recommendations by September 2020, as shown in figure 2.

Our June 2018 report also included 11 recommendations to CDC to  improve its information security program. In particular, we recommended  that the agency, among other things, evaluate system impact level  categorizations to ensure they reflect the current operating environment;  update risk assessments to identify threats and the likelihood of impact of  the threat on the environment; and update the facility risk assessments. In  addition, we recommended that the agency take the necessary steps to  make sure staff with significant security roles and responsibilities are  appropriately identified and receive role-based training; monitor the  configuration settings of agency systems to ensure the settings are set as  intended; update security control assessments to include an assessment  of controls using an appropriate level of rigor; and remediate POA&Ms in  a timely manner. Further, we recommended that the agency document  the cost-benefit analysis with associated risk of having an alternate site  within the same geographical region as the main site.

As of August 3, 2018, the agency had partially implemented 1 of the 11  information security program-related recommendations, but had not  provided any evidence that it had implemented the remaining 10  recommendations. Regarding the partially implemented recommendation,  CDC had provided role-based training to all personnel performing  significant security responsibilities. However, the agency still needed to  establish and automate the identification process and the tracking of  training records for individuals needing specialized security role-based  training. CDC had developed plans to fully implement this  recommendation and each of the remaining 10 information security  program-related recommendations by July 2019. Fully implementing the  open recommendations is essential to ensuring that the agency’s systems  and sensitive information are not at increased and unnecessary risk of  unauthorized use, disclosure, modification, or disruption.

We received written comments on a draft of this report from CDC. In its  comments, which are reprinted in appendix III, the agency stated that it  recognizes the risks associated with operating a large, global information  technology enterprise and has implemented processes, procedures, and  tools to better ensure the prevention, detection, and correction of potential  incidents. CDC also said cybersecurity remains a high priority and that it  takes the responsibilities for protecting public health information and data  entrusted to it seriously. To strengthen its cybersecurity program, the  agency stated that it is restructuring and streamlining the cyber program  and IT infrastructure of its Office of the Chief Information Officer.

Further, CDC stated that it has leveraged GAO’s limited official use only  report, issued in June 2018, to accelerate its implementation,  infrastructure, and software deployments to complete phrases one and  two of DHS’s Continuous Diagnostics and Mitigation program. The  agency also said it concurred with, and highlighted a number of actions  that it had planned or begun taking to remediate, the 11 security program  recommendations that we made to CDC in our June 2018 report.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of Health and Human Services, and the  department’s Office of the Inspector General, the Director of CDC, and  interested congressional parties. In addition, the report will be available at  no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov, or Dr.  Nabajyoti Barkakati at (202) 512-4499 or barkakatin@gao.gov. GAO staff  who made key contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

Our objective was to assess the extent to which CDC had effectively  implemented an information security program and controls to protect the  confidentiality, integrity, and availability of its information on selected  information systems. In June 2018, we issued a report which detailed the  findings from our work in response to this objective. In the report, we  made 184 recommendations to CDC to resolve the technical security  control deficiencies in the information systems we reviewed and 11  additional recommendations to improve its information security program.  We designated that report as “limited official use only” (LOUO) and did  not release it to the general public because of the sensitive information it  contained.

This report publishes the findings discussed in our June 2018 report, but  we have removed all references to the sensitive information. Specifically,  we deleted the names of the information systems and computer networks  that we examined, disassociated identified control deficiencies from  named systems, deleted certain details about information security  controls and control deficiencies, and omitted an appendix that was  contained in the LOUO report. The appendix contained sensitive details  about the technical security control deficiencies in the CDC’s information  systems and computer networks that we reviewed, and the 184  recommendations we made to mitigate those deficiencies. We also  provided a draft of this report to CDC officials to review and comment on  the sensitivity of the information contained herein and to affirm that the  report can be made available to the public without jeopardizing the  security of CDC’s information systems and networks.

In addition, this report addresses a second objective that was not  included in the June 2018 report. Specifically, this objective was to  determine the extent to which CDC had taken corrective actions to  address the previously identified security program and technical control  deficiencies and related recommendations for improvement that we  identified in the earlier report.

As noted in our June 2018 report, we determined the extent to which  CDC had effectively implemented an information security program and  controls to protect the confidentiality, integrity, and availability of its  information on selected information systems. To do this, we initially  gained an understanding of the overall network environment, identified  interconnectivity and control points, and examined controls for the  agency’s networks and facilities. We conducted site visits at two CDC  facilities in Atlanta, Georgia.

To evaluate CDC’s controls over its information systems, we used our  Federal Information System Controls Audit Manual, which contains  guidance for reviewing information system controls that affect the  confidentiality, integrity, and availability of computerized information. We  based our assessment of controls on requirements identified by the  Federal Information Security Modernization Act of 2014 (FISMA), which  establishes key elements for an effective agency-wide information  security program; NIST guidelines and standards; Department of Health  and Human Services and CDC policies, procedures, and standards; and  standards and guidelines from relevant security organizations, such as  the National Security Agency, the Center for Internet Security, and the  Interagency Security Committee.

We had reviewed a non-generalizable sample of the agency’s information  systems, focusing on those systems that (1) collect, process, and  maintain private or potentially-sensitive proprietary business, medical,  and personally identifiable information; (2) are essential to CDC’s  mission; and (3) were assigned a Federal Information Processing  Standard rating of moderate or high impact. Based on these criteria, we  had selected eight mission-essential systems for our review.

Of these systems, the agency had categorized 7 as high-impact systems  and 1 as a moderate-impact system. For these 8 selected mission- essential systems, we had reviewed information security program-related  controls associated with risk assessments, security plans, security control  assessments, remedial action plans, and contingency plans.

To assess the safeguards CDC implemented for its systems, we had  examined technical security controls for 24 CDC systems, including  systems the agency designated as high-value assets. These included 10  key systems, 8 of which were high- and moderate-impact mission- essential systems just described, 1 additional high-impact system, 1  additional moderate-impact system, and 14 general support systems. We  selected the additional high-impact system because the agency re- categorized it as a high-impact system during our review. We selected the  additional moderate-impact system because the agency used it to control  physical access to highly sensitive CDC biologic lab facilities, including  facilities that handle dangerous and exotic substances that cause  incurable and deadly diseases.

We selected 10 key systems, 8 of which were mission-essential systems,  for review that (1) collect, process, and maintain private or potentially  sensitive proprietary business, medical, and personally identifiable  information; (2) are essential to CDC’s mission; (3) could have a  catastrophic or severe impact on operations if compromised; or (4) could  be of particular interest to potential adversaries. We also selected 14  general support systems that were part of the agency’s network  infrastructure supporting the 10 key systems.

To review controls over the 10 key systems and 14 general support  systems, we had examined the agency’s network infrastructure and  assessed the controls associated with system access, encryption,  configuration management, and logging and monitoring. For reporting  purposes, we had categorized the security controls that we assessed into  the five core security functions described in the National Institute of  Standards and Technology’s (NIST) cybersecurity framework. The five  core security functions are:  Identify: Develop the organizational understanding to manage  cybersecurity risk to systems, assets, data, and capabilities.

Protect: Develop and implement the appropriate safeguards to  ensure delivery of critical infrastructure services.

Detect: Develop and implement the appropriate activities to identify  the occurrence of a cybersecurity event.

Respond: Develop and implement the appropriate activities to take  action regarding a detected cybersecurity event.

Recover: Develop and implement the appropriate activities to  maintain plans for resilience and to restore any capabilities or services  that were impaired due to a cybersecurity event.

These core security functions are described in more detail in appendix II.

For the identify core security function, we had examined CDC’s reporting  for its hardware and software assets; analyzed risk assessments for the  eight selected mission-essential systems to determine whether threats  and vulnerabilities were being identified; reviewed risk assessments for  two facilities; analyzed CDC policies, procedures, and practices to  determine their effectiveness in providing guidance to personnel  responsible for securing information and information systems; and  analyzed security plans for the eight selected systems to determine if  those plans had been documented and updated according to federal  guidance. We also evaluated the risk assessments for two facilities that  housed the 8 mission-essential selected systems.

For the protect core security function, we had examined access controls  for the 24 systems. These controls included the complexity and expiration  of password settings to determine if password management was being  enforced; administrative users’ system access permissions to determine  whether their authorizations exceeded the access necessary to perform  their assigned duties; firewall configurations, among other things, to  determine whether system boundaries had been adequately protected;  and physical security controls to determine if computer facilities and  resources were being protected from espionage, sabotage, damage, and  theft.

We also had examined configurations for providing secure data  transmissions across the network to determine whether sensitive data  were being encrypted. In addition, we had examined configuration  settings for routers, network management servers, switches, firewalls,  and workstations to determine if settings adhered to configuration  standards, and inspected key servers and workstations to determine if  critical patches had been installed and/or were up-to-date. Further, we  had examined training records to determine if employees and contractors  had received security awareness training according to federal  requirements, and whether personnel who have significant security  responsibilities had received training commensurate with those  responsibilities.

For the detect core security function, we had analyzed centralized logging  and network traffic monitoring capabilities for key assets connected to the  network; analyzed CDC’s procedures and results for assessing security  controls to determine whether controls for the eight selected mission- essential systems had been sufficiently tested at least annually and  based on risk. We also had reviewed the agency’s implementation of  continuous monitoring practices to determine whether the agency had  developed and implemented a continuous monitoring strategy to manage  its information technology assets and monitor the security configurations  and vulnerabilities for those assets.

For the respond core security function, we had reviewed CDC’s  implementation of incident response practices, including an examination  of incident tickets for 11 incidents; and had examined the agency’s  process for correcting identified deficiencies for the eight selected  mission-essential systems.

For the recover core security function, we had examined contingency  plans for eight selected mission-essential systems to determine whether  those plans had been developed and tested. In assessing CDC’s controls  associated with this function, as well as the other four core functions, we  had interviewed Office of the Chief Information Officer officials, as  needed.

Within the core security functions, as appropriate, we had evaluated the  elements of CDC’s information security program based on elements  required by FISMA. For example, we analyzed risk assessments, security  plans, security control assessments, and remedial action plans for each  of the 8 selected mission-essential systems. In addition, we had assessed  whether the agency had ensured staff had completed security awareness  training and whether those with significant security responsibilities  received commensurate training. We also had evaluated CDC’s security  policies and procedures.

To determine the reliability of CDC’s computer-processed data for training  and incident response records, we had evaluated the materiality of the  data to our audit objective and assessed the data by various means,  including reviewing related documents, interviewing knowledgeable  agency officials, and reviewing internal controls. Through a combination  of methods, we concluded that the data were sufficiently reliable for the  purposes of our work.

To accomplish our second objective—on CDC’s actions to address the  previously identified security program and technical control deficiencies  and related recommendations—we requested that the agency provide a status report of its actions to implement each of the recommendations.  For each recommendation that CDC indicated it had implemented as of  August 3, 2018, we examined supporting documents, observed or tested  the associated security control or procedure, and/or interviewed the  responsible agency officials to assess the effectiveness of the actions  taken to implement the recommendation or otherwise resolve the  underlying control deficiency. Based on this assessment and CDC status  reports, we defined the status of each recommendation into the following  3 categories: closed-implemented—CDC had implemented the recommendation; open-partially implemented—CDC had made progress toward, but  had not completed, implementing the recommendation; and open-not implemented—CDC had not provided evidence that it had  acted to implement the recommendation.

We conducted this performance audit from December 2016 to December  2018 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Appendix II: The National Institute of Standards and Technology Cybersecurity Framework

The National Institute of Standards and Technology’s cybersecurity  framework consists of five core functions: identify, protect, detect,  respond, and recover. Within the five functions are 23 categories and  108 subcategories, as described in the table.

Appendix III: Comments from Department of Health and Human Services

Appendix IV: GAO Contacts and Staff Acknowledgments

In addition to the individuals named above, Gary Austin, Jennifer R.  Franks, Jeffrey Knott, and Chris Warweg (assistant directors); Chibuikem  Ajulu-Okeke, Angela Bell, Sa’ar Dagani, Nancy Glover, Chaz Hubbard,  George Kovachick, Sean Mays, Kevin Metcalf, Brandon Sanders, Michael  Stevens, Daniel Swartz, and Angela Watson made key contributions to  this report. Edward Alexander, Jr. and Duc Ngo (assistant directors);  David Blanding, and Christopher Businsky also provided assistance.

IT systems at the Centers for Disease Control and Prevention are critical to securing sensitive data about the nation's health.

In June 2018, we reported numerous deficiencies in CDC's information security program and controls that CDC used to identify risk, protect systems, detect and respond to cybersecurity events, and recover operations after such events. These deficiencies place sensitive information at higher risk of unauthorized disclosure, modification, or interruption.

Since then, CDC has made significant progress bolstering its security by implementing 102 of our 195 recommendations and plans to address many more by September 2019.