VA Health Care: Improved Oversight Needed for Reusable Medical Equipment

VHA operates one of the largest health care delivery systems in the nation, serving over 9 million enrolled veterans. In providing health care services to veterans, VAMCs use RME which must be reprocessed—that is, cleaned, disinfected, or sterilized—between uses. Improper reprocessing of RME can negatively affect patient care. To help ensure the safety of veterans, VHA policy establishes requirements VAMCs must follow when reprocessing RME and requires a number of related oversight efforts.

GAO was asked to review VHA's reprocessing of RME. This report examines (1) VHA's oversight of VAMCs' adherence to RME policies and (2) challenges VAMCs face in operating their Sterile Processing Services programs, and any efforts by VHA to address these challenges. GAO reviewed relevant VHA documents including RME policies and VISN inspection results for fiscal year 2017. GAO interviewed officials from VHA, all 18 VISNs, and four VAMCs, selected based on geographic variation, VAMC complexity, and data on operating room delays. GAO examined VHA's oversight in the context of federal internal control standards on communication, monitoring, and information.

GAO found that the Department of Veterans Affairs' (VA) Veterans Health Administration (VHA) does not have reasonable assurance that VA Medical Centers (VAMC) are following policies related to reprocessing reusable medical equipment (RME). Reprocessing involves cleaning, sterilizing, and storing surgical instruments and other RME, such as endoscopes. VHA has not ensured that all VAMCs' RME inspections have been conducted because it has incomplete information from the annual inspections by Veterans Integrated Service Networks (VISN), which oversee VAMCs. For fiscal year 2017, VHA did not have 39 of the 144 VISN reports from the VISNs' inspections of their VAMCs' Sterile Processing Services departments. VISNs were able to provide GAO with evidence that they had conducted 27 of the 39 missing inspections; top areas of non-adherence in these inspections were related to quality and training, among other things. Although VHA has ultimate oversight responsibility, a VHA official told GAO that VHA had not been aware it lacked complete inspection results because it has largely relied on the VISNs to ensure complete inspection result reporting. Without analyzing and sharing complete information from inspections, VHA does not have assurance that its VAMCs are following RME policies designed to ensure that veterans receive safe care.

GAO also found that VAMCs face challenges operating their Sterile Processing Services programs—notably, addressing workforce needs. Almost all of the officials from all 18 VISNs and selected VAMCs GAO interviewed reported Sterile Processing Services workforce challenges, such as lengthy hiring timeframes and limited pay and professional growth potential. According to officials, these challenges result in programs having difficulty maintaining sufficient staffing. VHA officials told GAO that the office is considering studying Sterile Processing Services staffing at VAMCs, although VHA does not have definitive plans to do so. VHA's Sterile Processing Services workforce challenges pose a potential risk to VAMCs' ability to ensure access to sterilized medical equipment, and VHA's failure to address this risk is inconsistent with standards for internal control in the federal government. Until VHA examines these workforce needs, VHA won't know whether or to what extent the reported challenges adversely affect VAMCs' ability to effectively operate their Sterile Processing Services programs and ensure access to safe care for veterans.

GAO is making three recommendations to VHA, including that it ensure all RME inspections are being conducted and complete results reported, and that it examine Sterile Processing Services workforce needs and make adjustments, as appropriate. VA concurred with these recommendations.

The Department of Veterans Affairs’ (VA) Veterans Health Administration  (VHA) operates one of the largest health care delivery systems in the  nation, serving over 9 million enrolled veterans. In providing health care  services to veterans, VA medical centers (VAMC) use reusable medical  equipment (RME), such as endoscopes and surgical instruments, which  must be reprocessed—that is, cleaned, disinfected, or sterilized— between uses. As medical instruments have become more complex,  reprocessing has become more complicated and time consuming. For  example, reprocessing an endoscope after a colonoscopy requires eight  detailed cleaning steps and, on average, over 1 hour and 15 minutes of  hands-on staff time. Improper reprocessing of RME creates risks to  patient safety—exposing patients to infection, for example—and can  adversely affect timely access to care, such as when surgeries are  delayed or canceled due to the lack of properly reprocessed medical  equipment. The reprocessing of RME occurs at VAMCs within their  Sterile Processing Services (SPS) programs. To help ensure the safety  of veterans who receive care at its facilities, VHA policy establishes  requirements VAMCs must follow when reprocessing RME. Further, VHA  policy requires inspections to be completed each year to determine the  extent to which VAMCs are following these RME requirements and that  incidents involving improperly reprocessed RME are reported.

VHA has had ongoing challenges with RME reprocessing. For example,  in 2009, two VAMCs notified about 10,000 veterans of their potential  exposure to hepatitis B, hepatitis C, and HIV, because they received care  using improperly reprocessed endoscopes. In 2011 we found that VHA  had not provided sufficient guidance to VAMC staff operating the SPS  programs to ensure that staff were reprocessing RME correctly, which  posed potential safety risks to veterans. In 2016, the VHA Office of the  Medical Inspector reviewed and corroborated allegations that the SPS  department at a VAMC failed to provide surgeons with RME free of  bioburden, debris, or both. Further, in March 2018, the VA Office of  Inspector General reported on problems at a VAMC that included RME- specific issues, such as delays and cancellations of procedures due to  unavailable instruments because of improper reprocessing.

You asked us to review RME reprocessing within VHA. In this report, we  examine:  1.  VHA’s oversight of VAMCs’ adherence to RME policies and  2.  challenges VAMCs face in operating their SPS programs, and any  efforts by VHA to address these challenges.

To examine VHA’s oversight, we assessed its efforts to oversee VHA’s 18  Veterans Integrated Service Networks (VISN) and its efforts to directly  ensure that VHA’s 170 VAMCs are adhering to RME policies. We  reviewed VHA Directive 1116(2), which describes RME policy  requirements and instructions for how inspections of VAMCs’ adherence  to these requirements should be conducted, and VHA’s guide to issue  briefs, which are reports that provide information on incidents involving  improperly processed RME. We reviewed summary data from VHA on  inspections of VAMCs conducted by their respective VISNs in fiscal year  2017. These summary data came from inspection reports submitted to  VHA by the VISNs for which VHA had records as of February 2018. We  also reviewed the full inspection reports that we obtained from the VISNs  for inspections VISNs had conducted in fiscal year 2017, but for which  VHA did not have records, which identified information about non- adherence to RME policy requirements. Finally, we reviewed VHA’s  summary of issue briefs, including those related to the improper  reprocessing of RME, for fiscal years 2015 through 2017.

To assess the reliability of the inspection and issue brief data, we  reviewed the data to identify missing information and discrepancies, and  we interviewed VHA officials regarding the processes for collecting and  verifying the data. Based on these efforts, we determined that VHA data  on the number of VISN inspection reports for which they had records,  VISN inspection reports, and VHA summary data from issue briefs were  reliable for the purposes of our reporting objectives. In addition to our  review of inspection and issue brief data, we interviewed VHA, VISN, and  VAMC officials. Specifically, we interviewed VHA officials from the  National Program Office for Sterile Processing, which is responsible for  developing RME policies and overseeing VAMCs’ adherence to these  policies. We also interviewed officials from the 18 VISNs and four  selected VAMCs to get their views on VHA’s oversight. We assessed  VHA’s oversight efforts in the context of federal standards for internal  control for monitoring, information, and communication.

To examine challenges VAMCs face in operating their SPS programs, we  reviewed VHA’s RME policy and other documents to identify the  requirements VAMCs must follow in operating their SPS programs, and  we interviewed officials with direct knowledge of these efforts at all 18  VISNs and the four selected VAMCs. In addition, we asked operating  room nurse managers from 20 selected VAMCs to identify in writing any  RME-related challenges they faced as a result of the SPS department at  their VAMC, such as delays in operating room procedures due to RME  issues. We discussed the challenges identified with officials from VHA’s  National Program Office for Sterile Processing and the Workforce  Management and Consulting Office. We assessed VHA’s efforts to  address RME-related challenges in the context of federal standards for  internal control for risk assessment.

Finally, to provide a contextual understanding of RME issues across both  objectives, we visited a VAMC with a large SPS program and interviewed  officials outside of VHA with relevant knowledge. Specifically, we  conducted an in-person site visit at the Seattle VAMC and spoke to  officials involved in the SPS program, such as the SPS Chief and staff,  VAMC leadership, and the Chief of Surgery and operating room Nurse  Manager. Further, we spoke with officials from organizations with RME  industry knowledge, such as the International Association of Healthcare  Central Service Materiel Management and the Association for the  Advancement of Medical Instrumentation—two professional associations  that set RME reprocessing standards used by VHA and others, offer RME  certification, and provide information and support regarding RME  reprocessing to those working in the industry. We also interviewed  officials from the Joint Commission and the VA Office of Inspector  General who periodically review VAMCs’ SPS programs and contacted  three Veterans Service Organizations to obtain their views on concerns  related to RME reprocessing and suggestions for addressing those  concerns.

We conducted this performance audit from April 2017 to June 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

In providing health care services to veterans, clinicians at VAMCs use  RME, such as endoscopes and surgical instruments, which must be  reprocessed between uses. Reprocessing covers a wide range of  instruments and has become increasingly complex. VHA has developed  policies that VAMCs are required to follow to help ensure that RME is  reprocessed correctly. In addition, VHA policy requires that VHA and  VISNs oversee VAMCs’ reprocessing of RME and that VAMCs report  incidents involving improperly reprocessed RME.

According to reports from RME professional associations, the complexity  of RME reprocessing has increased as the complexity of medical  instruments has increased. While at one time reprocessing surgical and  dental instruments such as scalpels and retractors might have been the  bulk of a SPS program’s tasks, now SPS programs are responsible for  reprocessing complex instruments such as endoscopes. Reprocessing  these instruments is a detailed and time-consuming process, and their  increasing complexity requires a corresponding increase in the skills and  time required to safely reprocess them. (See figure 1 for an example of  steps that can be required for endoscope reprocessing.)

VHA Roles and Responsibilities for RME Reprocessing

Within VHA, the National Program Office for Sterile Processing under the  VHA Deputy Under Secretary of Health for Operations and Management  is responsible for developing RME reprocessing policies. It is also  responsible for ensuring that VISNs and their respective VAMCs are  adhering to its policies. Each of the 18 VISNs are responsible for ensuring  adherence with VHA’s RME policies at the VAMCs within its region. In  turn, each of the 170 VAMCs are responsible for implementing VHA’s  policies related to RME. Within each VAMC, the SPS department is  primarily responsible for reprocessing RME, which is used by clinicians in  the operating room and other clinical service lines such as the dental and  gastroenterology service. (See fig. 2.) Additionally, the SPS department  collaborates with other VAMC departments such as the Environmental  Management and Engineering Services on variables that affect RME  reprocessing, such as the climate where RME is reprocessed.

VHA Policies for RME Reprocessing and Related Oversight

In March 2016 VHA issued Directive 1116(2)—a comprehensive policy  outlining requirements for SPS programs and for overseeing RME  reprocessing efforts.

SPS program operation requirements. To help ensure that VAMCs are  reprocessing RME correctly, VHA policy establishes various requirements  for the SPS programs in VAMCs to follow, such as a requirement that  SPS staff monitor sterilizers to ensure that they are functioning properly,  use personal protective equipment when performing reprocessing  activities, separate dirty and clean RME, and maintain environmental  controls. For example, VAMCs are required to maintain certain  temperature, humidity, and air flow standards in areas where RME is  reprocessed and stored. Additionally, in order to ensure that RME is  reprocessed in accordance with manufacturers’ guidelines, VAMCs are  required to assess staff on their competence in following the related  reprocessing steps.

Oversight requirements. To help ensure that VAMCs are adhering to  VHA’s RME policies, VHA requires inspections, reports on incidents of  improperly reprocessed RME, and corrective action plans for both non- adherent inspection results and incidents of improperly reprocessed  RME.

Inspections. VISNs are required to conduct annual inspections at  each VAMC within their VISN and to report their inspection results to  the VHA National Program Office for Sterile Processing. The VISN  inspections are a key oversight tool for regularly assessing adherence  to RME policies in the SPS, gastroenterology, and dental areas within  VAMCs and use a standardized inspection checklist known as the  SPS Inspection Tool. According to VHA officials, VHA developed the  SPS Inspection Tool and generally updates it annually. The most  recent fiscal year 2017 SPS Inspection Tool contained 148  requirements. Examples of requirements include those regarding  proper storage of RME and following manufacturers’ instructions  when reprocessing RME. Although VAMCs are also required to  conduct annual self-inspections using the SPS Inspection Tool and  report the results to VHA, the VISN annual inspections are a separate  and important level of oversight. Finally, according to VHA officials,  while not a formal policy, VHA’s National Program Office for Sterile  Processing also inspects each VAMC at least once every 3 years.  VHA requires VISNs and VAMCs to conduct their own inspections  even in years when VHA also conducts inspections.

Incident Reports. VHA collects incident reports or “issue briefs”  generated by VAMCs on incidents involving RME to help determine  the extent to which VAMCs are adhering to RME policies, among  other things. VHA requires VAMCs to report significant clinical  incidents or outcomes involving RME that negatively affect groups or  a cohort of veterans in an issue brief. According to a VHA official,  when VAMC staff report incidents involving RME to their facility  leadership, these officials should follow VHA guidance to determine  which incidents, if any, should be reported in an issue brief to the  VAMC’s VISN. Similarly, VISN officials, in turn, are responsible for  determining whether an incident should be reported in an issue brief  to VHA.

Corrective Action Plans. Corrective action plans—which detail an  approach for addressing any areas of policy non-adherence identified  in inspections or incidents identified in issue briefs—are required at  both the VISN and VAMC levels. Specifically, both VISNs and VAMCs  are required to develop corrective action plans for any deficiencies  identified through their inspections, and VAMCs are required to  develop corrective action plans for incidents identified in issue briefs.  According to a VHA official, VISNs and VAMCs are not required to  send corrective action plans from inspections to VHA; however,  VAMCs must send their correction action plans to the VISN and also  any related to issue briefs to VHA. Further, according to a VHA  official, although neither the VAMC nor VISN corrective action plans  from inspections are monitored by VHA, VHA does expect VISN  officials to inform it of any critical issues that VISNs believe warrant  VHA attention. For example, VHA officials would expect VISNs to  report instances when RME issues result in the cancellation of  procedures for multiple patients or when the VISN discovers a VAMC  is lacking documentation of RME reprocessing competency  assessments for a large number of their SPS staff.

Reports on Issues Related to RME Reprocessing

A number of recent reports have identified several RME-related issues at  VAMCs, including non-adherence to RME policies. The issues have  ranged from improperly reprocessed RME being used on patients to the  cancellation of medical procedures due to lack of available RME. For  example:  In March 2018, the VA Office of Inspector General released a report  describing problems identified at the Washington, D.C. VAMC, some  of which were RME-related. For example, the office determined that  ineffective sterile processing contributed to procedure delays due to  unavailable RME. The report included specific recommendations,  such as ensuring there are clearly defined and effective procedures  for replacing missing or broken instruments and implementing a  quality assurance program to verify the cleanliness, functionality, and  completeness of instrument sets before they are used in clinical  areas. The VAMC Director agreed with those recommendations.

In fiscal year 2017, the VA Office of Inspector General reviewed 29  VAMCs and issued reports for each in response to several RME- related complaints received through its reporting hotline. The office  identified issues such as staff failure to perform quality control testing  on endoscopes or document their competency assessments of SPS  staff in employee files. Many of the reports included specific  recommendations, such as performing quality control testing on all  endoscopes and ensuring SPS staff are assessed for competency at  orientation and annually for the types of RME they reprocess. The  VAMC Directors agreed with those recommendations.

In 2016, the VA Office of the Medical Inspector released a report that  substantiated allegations that SPS practices led to the delivery of  RME with bioburden, debris, or both to the operating room. The  report included specific recommendations, such as reeducating SPS  staff on proper SPS standards and ensuring that all training and  assessments of RME reprocessing competency of SPS staff are  completed as required. The VAMC Director agreed with those  recommendations.

In 2011, we released a report on VA RME that found issues with RME  reprocessing. We found, for example, that VHA did not provide  specific guidance on the types of RME that require device-specific  training and that the guidance VHA did provide on RME reprocessing  training was conflicting. We issued several recommendations for  improvement, which VA has implemented.

VHA’s Oversight Does Not Provide Reasonable Assurance that VAMCs Are Following RME Policies

VHA Does Not Have Complete Information on Adherence to RME Policies from Inspections of VAMCs

VHA has not ensured that it has complete information from the annual  inspections VISNs conduct—a key oversight tool providing the most  current VA-wide information on adherence to RME policies—and  therefore does not have reasonable assurance that VAMCs are following  RME policies intended to ensure veterans are receiving safe care.

For fiscal year 2017, we determined that VHA should have had records of  144 VISN SPS inspection reports to have assurance that all required  VISN SPS inspections had been conducted. However, our review shows  that as of February 2018, VHA had 105 VISN SPS inspection reports and  was missing 39, or more than one quarter of the required inspection  reports. We also determined that there were two VISNs from which VHA  did not have any fiscal year 2017 reports. For the missing SPS inspection  reports, VISN officials suggested several reasons why the inspections  were either not conducted or conducted but the reports were not  submitted to VHA. For example, officials from one of the VISNs from  which VHA had no SPS inspection reports told us that VISN management  staffing vacancies prevented it from conducting all of its inspections. An  official from the other VISN from which VHA had no SPS inspection  reports provided evidence that it had conducted all but one of the  inspections, but the official told us the VISN did not submit reports  because it has yet to receive information from VHA regarding VISN  inspection outcomes, common findings, or best practices and therefore  sees no value in submitting them.

VISNs provided us with evidence showing that they conducted 27 of 39  inspections that were missing from VHA’s data. We analyzed these 27  reports to identify the information about non-adherence to RME policy  requirements that VHA does not have from these missing VISN  inspections. We determined the 10 requirements for which these VAMCs  had the most non-adherence were related to quality, training, and  environmental issues, among other things, with the extent of non- adherence ranging from 19 to 38 percent. For example, there were 19 and 26 percent non-adherence rates to the requirements that instrument  and equipment levels be sufficient to meet workloads and having a  process in place to ensure staff receive make-up/repeat training,  respectively. (See Appendix I.)

We also found that variation in SPS Inspection Tools and related  guidance from VHA resulted in incomplete inspection results for the  gastroenterology and dental areas. VHA provided VISNs with three  different SPS Inspection Tools throughout the course of fiscal year  2017. Although VHA guidance stated otherwise, only the third SPS  Inspection Tool—which was used during the second half of the fiscal  year—contained requirements specific to the gastroenterology and dental  areas.

A VHA Central Office official told us the office hadn’t been aware that it  did not have all of the VISN inspection reports until it took steps to  respond to our data request. The official told us VHA granted VISNs a 3- month extension for fiscal year 2017—meaning that VISNs had until the  end of December 2017 to submit their inspection results—and had  granted similar extensions for at least the past 4 fiscal years as well. For  all of those years, the VHA official told us that the office didn’t have all  VISN inspection reports, even after granting extensions. As a result, VHA  did not have assurance that all of the inspections had been conducted.  When asked why VHA hadn’t been aware that it didn’t have all VISN SPS  inspection reports, a VHA official said that the office has largely relied on  the VISNs to ensure complete inspection result reporting because it  hasn’t had the resources to dedicate to monitoring inspections. The  official told us that VHA has asked for and just recently received approval  to hire a data analyst who could potentially be responsible for monitoring  the VISN inspection reports. VHA’s lack of complete information from  inspection results is inconsistent with standards for internal control in the  federal government regarding monitoring and information that state  management should establish and operate monitoring activities and use  quality information to achieve the entity’s objectives. Without such  controls, VHA lacks reasonable assurance that VAMCs are following  RME policies designed to ensure that veterans are receiving safe care.

VHA Does Not Consistently Share Information that Could Help VAMCs Follow RME Policies

We also found that VHA does not consistently share information,  particularly inspection results, with VISNs and VAMCs, and that VISNs  and VAMCs would like more of this information. Specifically, about two- thirds of VISN and VAMC officials told us that sharing information on the  common issues identified in the inspections of other VAMCs as well as  potential solutions developed to address these issues would allow  VAMCs to be proactive in strengthening their adherence to RME policies  and ensuring patient safety. For example, a VAMC official told us that  there were problems with equipment designed to sterilize heat- and  moisture sensitive devices, and seeing how other VAMCs addressed the  problem was helpful for their VAMC. Further, officials from some VISNs  said VHA cited their VAMCs for issues that had been found at other  facilities and, had the VAMCs been aware of the issue beforehand, they  could have corrected or improved their processes earlier.

When asked about sharing inspection results and other information, VHA  Central Office officials told us the office doesn’t analyze or share  information from VISN inspections because of a lack of resources. A VHA  official told us that the office does create an internal report of common  issues identified through the third of VAMCs it inspects each year, but the  office doesn’t share this report with VISNs and VAMCs because the office  lacks the resources needed to prepare reports that are detailed enough to  be understood correctly by recipients. According to this official, VHA has  occasionally shared information it has identified on common inspection  issues through newsletters, national calls, and trainings; however, VHA  officials at close to half of the VISNs and VAMCs we spoke to said that  they rarely or never get this information. For example, officials from one  VISN told us they recall only one or two instances where VHA sent a  summary of the top five RME-related issues found during inspections.  Insufficient sharing of information is inconsistent with standards for  internal control in the federal government regarding communication,  which state that management should internally communicate the  necessary quality information to achieve the entity’s objectives. Until this  sharing becomes a regular practice, VHA is missing an opportunity to  help ensure adherence to its RME policies, which are intended to ensure  that veterans receive safe care.

VAMCs Report Facing Challenges Related to RME Policies and Workforce Needs, but VHA Has Not Sufficiently Addressed These Challenges

According to interviews with officials from all of the VISNs and selected  VAMCs, the top five challenges VAMCs face in operating their SPS  programs are related to meeting certain RME policies and challenges  addressing SPS workforce needs. In particular, officials told us that  VAMCs have challenges (1) meeting two RME policy requirements  related to climate control monitoring and a reprocessing transportation  deadline, and (2) addressing SPS workforce needs related to lengthy  hiring timeframes, the need for consistent overtime, and limited pay and  professional growth. (See Table 1.)

Regarding the challenges VAMCs face in meeting RME policy  requirements, the majority of VISN and selected VAMC officials  interviewed reported experiencing challenges adhering to two  requirements from 2016 VHA issued Directive 1116(2).

Climate control monitoring requirement. Officials reported that  meeting the climate control monitoring requirement related to airflow  and humidity is challenging for their VAMCs. Under the requirement  VAMCs must monitor the humidity and airflow in facility areas where  RME is reprocessed and stored in order to ensure that humidity levels  do not exceed a certain threshold and thereby allow the growth of  microorganisms. According to almost all VISN officials, meeting the  requirement is a challenge for some, if not all, of their VAMCs and in  particular for older VAMCs that lack proper ventilation systems. We  also found some instances of non-adherence on this issue in the  group of VISN inspection reports we reviewed. In a September 2017  memorandum, VHA relaxed the requirement (e.g., adjusted the  thresholds). Additionally, according to a VHA official, VHA wants to  renovate all outdated VAMC heating, ventilation, and air conditioning  systems to help VAMCs meet the requirement. Further, according to  VHA officials, VHA also allows VAMCs to apply for a waiver  exempting them from having to meet this requirement if they have an  action plan in place that shows they are working toward meeting the  requirement.

Reprocessing transportation deadline requirement. Officials reported  that meeting the reprocessing transportation deadline was also  challenging for their VAMCs. Under the requirement, used RME  must be transported to the location where it will be reprocessed within  4 hours of use to prevent bioburden or debris from drying on the  instrument and causing challenges with reprocessing. Officials  reported this requirement as particularly challenging for VAMCs that  must transport their RME to another facility for cleaning, such as  community based outpatient clinics in rural areas that must transport  their RME to their VAMC’s SPS department. We also found some  instances of non-adherence on this issue in the group of VISN  inspection reports we reviewed. In June 2016, VHA issued a  memorandum allowing the use of a pre-cleaning spray solution that, if  used, allows offsite facilities such as community based outpatient  clinics to transport that RME within 12 hours instead of the required 4  hours.

VHA has made some adjustments to these requirements, although some  officials told us the requirements remain difficult to meet. Specifically,  over half of the VISN officials reported that the climate control monitoring  requirement continues to be a challenge for their VAMCs. Further, some  of the officials told us that meeting the 12-hour reprocessing  transportation requirement using the pre-cleaning spray was still  challenging, due to the distance between clinics and their VAMC’s SPS  department; as a result, some facilities have decided to use disposable  medical equipment that does not require reprocessing to avoid this  requirement completely. When we shared this information with a VHA  official, the official stated that providing general information on how all  facilities can meet the climate control monitoring requirement is  impossible due to the uniqueness of each facility and that VHA has no  further plans to adjust the reprocessing transportation deadline  requirement. However, these challenges remain and some officials have  expressed frustration with the limited support they’ve received from VHA.  In September 2017 we recommended that VHA establish a mechanism  by which program offices systematically obtain feedback from VISNs and  VAMCs on national policy after implementation and take the appropriate  actions. Our findings provide further evidence of the need for VA to  address this recommendation.

Regarding the challenges VAMCs face in meeting SPS workforce needs,  almost all of the 18 VISN officials and officials from the three selected  VAMCs reported experiencing challenges related to lengthy hiring  timeframes, need for consistent overtime, and limited pay and  professional growth. According to officials, these challenges result in SPS  programs having difficulty maintaining sufficient staffing levels.

Lengthy hiring timeframes. Officials reported that the lengthy hiring  process for SPS staff creates challenges in maintaining sufficient SPS  workforce. For example, officials from one VISN estimated that on  average it can take 3 to 4 months for a person to be hired. Officials  from a few other VISNs noted that not only does the lengthy hiring  process create challenges in recruiting qualified candidates (because  they accept other positions where they can be more quickly  employed), but that it also results in long periods of time when SPS  programs are short-staffed.

Need for overtime. Officials reported that needing their SPS staff to  work overtime is a challenge. Specifically, 16 of the 18 VISN officials  stated that there is a need for staff at their VAMCs to work overtime  either “all, most, or some of the time.” Further, officials from one VISN  told us their VAMCs have used overtime to meet the increased  workload required to implement VHA’s RME policies; one official  noted that the overtime has led to dissatisfaction and retention issues  among SPS staff.

Limited pay and professional growth. Officials identified limited pay  and professional growth associated with the current pay grade as the  biggest SPS workforce challenge. Almost all officials stated that the  current pay grade limits the pay and potential for professional growth  for the two main SPS positions—medical supply technicians, who are  responsible for reprocessing RME, and SPS Chiefs, who have  supervisory responsibility. Specifically, the relatively low maximum  allowable pay discourages staff from accepting or staying in positions  and the current pay grade does not create a career path for SPS  medical supply technicians to grow within the SPS department.  Officials from one VISN told us that all VAMCs in their VISN have lost  SPS staff due to the low pay grade for both positions. VHA officials  said a proposed increase in the pay grade for SPS staff has been  drafted; however, they do not know when or if it will be made effective.

Further, according to officials with knowledge of the proposed  changes, the changes could still be insufficient to recruit and retain  SPS staff with the necessary skills and experience.

Some VISN and VAMC officials told us that difficulties maintaining  sufficient SPS staff levels have in some instances adversely affected  patients’ access to care and increased the potential for reprocessing  errors that could affect patient safety. According to these officials, staffing  challenges can affect access to care when facilities have to limit or delay  care—such as surgeries—because there aren’t enough staff available to  process all the necessary RME. An official at one VAMC told us that their  SPS staff must review available RME daily to determine whether  scheduled surgeries or other procedures can proceed. Further, among  the 18 operating room nurse managers who responded to our inquiries,  15 indicated they have experienced operating room delays because of  RME issues. In addition, some VISN and VAMC officials told us staffing  challenges can potentially have an impact on patient safety, because  when SPS staffing is not sufficient, mistakes are more likely to occur. For  example, officials told us that if SPS staffing levels are low, particularly if  they are low for an extended period of time, there is an increased chance  RME will be improperly reprocessed and, if used on a patient, put that  patient’s safety at risk. A 2018 VA Office of Inspector General report on  the Washington D.C. VAMC found that consistent SPS understaffing was  a factor in SPS staff not being available to meet providers’ need for  reprocessed RME; according to the report, “veterans were put at risk  because important supplies and instruments were not consistently  available in patient care areas.”

While VHA is aware of these workforce challenges cited by VISN and  VAMC officials, it has not studied SPS staffing at VAMCs. As a result, it  does not know whether or to what extent the workforce challenges VISNs  and VAMCs report adversely affect VAMCs’ ability to effectively operate  their SPS programs and ensure safe care for veterans. A National  Program Office of Sterile Processing official indicated that while the office  might have access to some of the necessary data from VAMC SPS  departments, it does not have all the necessary data or staff needed to  assess SPS staffing levels. Furthermore, the official added, conducting  such a study would not be the responsibility of her office. Officials from  the Workforce Management and Consulting Office said VHA is  considering a study of SPS staffing, given the results of the VA Office of  Inspector General 2018 review that identified high vacancy rates as a  contributing factor to the challenges with the SPS program at the  Washington D.C. VAMC. However, VHA does not have definitive plans to  complete this type of study or a timeframe for when the decision will be  made. Until the study is conducted and actions are taken based on the  study, as appropriate, VHA will not have addressed a potential risk to its  SPS programs. This is inconsistent with standards for internal control in  the federal government for risk assessment, which state that  management should identify, analyze, and respond to risks related to  achieving defined objectives. Without examining SPS workforce needs,  and taking action based on this assessment, as appropriate, VHA lacks  reasonable assurance that its approach to SPS staffing helps ensure  veterans’ access to care and safety.

The proper reprocessing of surgical instruments and other RME used in  medical procedures is critical for ensuring veterans’ access to safe care.  We have previously found that VA had not provided enough guidance to  ensure SPS staff were reprocessing RME correctly; in 2016, VA issued  Directive 1116(2)—with requirements for the SPS program. While this is a  good step, our current review shows that VHA needs to strengthen its  oversight of VAMCs’ adherence to these requirements. VHA has not  ensured that it has complete information from inspections of VAMCs, nor  does VHA consistently share inspection results and other information that  could help VAMCs meet the requirements. Without analysis of complete  information from inspections and consistent sharing of this information,  VHA does not have reasonable assurance that VAMCs are following all  RME policies, and VHA is missing an opportunity to strengthen VAMCs’  adherence to RME requirements.

Furthermore, officials from some VISNs and selected VAMCs report  challenges meeting two RME policy requirements—the climate control  and the reprocessing transportation deadline requirements. If VHA  implements a recommendation we made in 2017 for the agency to obtain  feedback from VISNs and VAMCs on their efforts to implement VHA  policies and take the appropriate actions, it could help with these  challenges. Additionally, while nearly all of the officials from the 18 VISNs  and selected VAMCs interviewed reported challenges maintaining a  sufficient SPS workforce, VHA does not know whether the current SPS  workforce addresses VAMCs’ SPS workforce needs. VHA officials say  that VHA is considering studying its SPS workforce; however, it has not  done so or announced a timeframe for doing so. Until it conducts such a  study, VHA will not know whether or to what extent reported SPS  workforce challenges adversely affect the ability of VAMCs to effectively  operate their SPS programs and ensure access to safe care for veterans.

We are making the following three recommendations to VHA:

The Under Secretary of Health should ensure all RME inspections are  being conducted and reported as required and that the inspection  results VHA has are complete. (Recommendation 1)

The Under Secretary of Health should consistently analyze and share  top common RME inspection findings and possible solutions with  VISNs and VAMCs. (Recommendation 2)

The Under Secretary of Health should examine the SPS workforce  needs and take action based on this assessment, as appropriate.  (Recommendation 3)

We provided a draft of this report to VA for comment. In its written  comments, which are provided in appendix III, VA concurred with our  recommendations.

In its comments, VA acknowledged the need for complete RME  inspection information, stating that VHA will establish an oversight  process for reviewing and monitoring findings from site inspections and  for reporting this information to VHA leadership. Further, VA noted that  VHA will analyze data from RME inspections and share findings and  possible solutions with VISNs and VAMCs via a written briefing that will  be published on VHA’s website and discussed during educational  sessions and national calls. VA also noted that VHA has an  interdisciplinary work group that has identified actions it can take to  address SPS workforce needs, including implementing an enhanced  market-based approach for determining pay levels and developing a  staffing model so VAMCs can determine what staffing levels they need to  more effectively operate their SPS programs. VA expects VHA to  complete all of these actions by July 2019 or earlier.

As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the appropriate  congressional committees and the Secretary of Veterans Affairs. In  addition, the report will be available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  Sharon M. Silas at (202) 512-7114 or silass@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs can be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix III.

Appendix I: Top VHA Reusable Medical Equipment Issues among Select Veterans Affairs Medical Centers, Fiscal Year 2017

Our review of the 27 fiscal year 2017 inspections of VAMCs conducted by  Veterans Integrated Service Networks (VISN) for which VHA did not have  inspection reports identified a number of common reusable medical  equipment (RME) issues among the select VAMCs. The top 10 are listed  in table 2 below.

Appendix II: Percentage of Issue Briefs Related to Reusable Medical Equipment by Category, Fiscal Years 2015-2017

Our review of the Veterans Health Administration (VHA) summary of  issue briefs for fiscal years 2015 through 2017 identified three major  categories of issues related to reusable medical equipment (RME). See  table 3 below for the percentage of all issue briefs that fell into each of  these three categories.

Appendix III: Comments from the Department of Veterans Affairs

Appendix IV: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Karin Wallestad (Assistant  Director), Teresa Tam (Analyst-in-Charge), Kenisha Cantrell, Michael  Zose, and Krister Friday made major contributions to this report. Also  contributing were Kaitlin Farquharson, Diona Martyn, and Muriel Brown.

Reusable medical equipment, such as a flexible, camera-bearing endoscope, must be reprocessed between uses. It must be cleaned, disinfected or sterilized. The Veterans Health Administration has rules for such steps and oversees the process in VA Medical Centers.

We found VHA did not have complete reprocessing inspection results and can't ensure that its medical centers are following its rules. We also found VHA does not know whether its current workforce is adequate to operate reprocessing programs and ensure access to safe care for veterans.

We recommended that VHA take steps to ensure inspections occur and that it examine workforce needs.


Cybersecurity: DHS Needs to Enhance Efforts to Improve and Promote the Security of Federal and Private-Sector Networks

The emergence of increasingly sophisticated threats and continuous reporting of cyber incidents underscores the continuing and urgent need for effective information security. GAO first designated information security as a government-wide high- risk area in 1997. GAO expanded the high-risk area to include the protection of cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015.

Federal law and policy provide DHS with broad authorities to improve and promote cybersecurity. DHS plays a key role in strengthening the cybersecurity posture of the federal government and promoting cybersecurity of systems supporting the nation's critical infrastructures.

This statement highlights GAO's work related to federal programs implemented by DHS that are intended to improve federal cybersecurity and cybersecurity over systems supporting critical infrastructure. In preparing this statement, GAO relied on a body of work issued since fiscal year 2016 that highlighted, among other programs, DHS's NCPS, national integration center activities, and cybersecurity workforce assessment efforts.

In recent years, the Department of Homeland Security (DHS) has acted to improve and promote the cybersecurity of federal and private-sector computer systems and networks, but further improvements are needed. Specifically, consistent with its statutory authorities, DHS has made important progress in implementing programs and activities that are intended to mitigate cybersecurity risks on the computer systems and networks supporting federal operations and our nation's critical infrastructure. For example, the department has:

issued cybersecurity related binding operational directives to federal agencies;

served as the federal-civilian interface for sharing cybersecurity related information with federal and nonfederal entities;

Framework for Improving Critical Infrastructure Cybersecurity ; and

Nevertheless, the department has not taken sufficient actions to ensure that it successfully mitigates cybersecurity risks on federal and private-sector computer systems and networks. For example, GAO reported in 2016 that DHS's National Cybersecurity Protection System (NCPS) had only partially met its stated system objectives of detecting and preventing intrusions, analyzing malicious content, and sharing information. GAO recommended that DHS enhance capabilities, improve planning, and support greater adoption of NCPS.

In addition, although the department's National Cybersecurity and Communications Integration Center generally performed required functions such as collecting and sharing cybersecurity related information with federal and non-federal entities, GAO reported in 2017 that the center needed to evaluate its activities more completely. For example, the extent to which the center had performed its required functions in accordance with statutorily defined implementing principles was unclear, in part, because the center had not established metrics and methods by which to evaluate its performance against the principles. Further, in its role as the lead federal agency for collaborating with eight critical infrastructure sectors including the communications and dams sectors, DHS had not developed metrics to measure and report on the effectiveness of its cyber risk mitigation activities or on the cybersecurity posture of the eight sectors.

GAO reported in 2018 that DHS had taken steps to assess its cybersecurity workforce; however, it had not identified all of its cybersecurity positions and critical skill requirements.

Until DHS fully and effectively implements its cybersecurity authorities and responsibilities, the department's ability to improve and promote the cybersecurity of federal and private-sector networks will be limited.

Since fiscal year 2016, GAO has made 29 recommendations to DHS to enhance the capabilities of NCPS, establish metrics and methods for evaluating performance, and fully assess its cybersecurity workforce, among other things. As of April 2018, DHS had not demonstrated that it had fully implemented most of the recommendations.

Thank you for the opportunity to appear at today’s hearing on how federal  government programs implemented by the Department of Homeland  Security (DHS) are mitigating cybersecurity risk for federal and private- sector networks. As recent cyberattacks have illustrated, the need for  robust and effective cybersecurity has never been greater.

At your request, I will provide an overview of our work issued since 2016  related to federal programs implemented by DHS that are intended to  improve federal cybersecurity and cybersecurity over systems supporting  critical infrastructure. My statement highlights our cybersecurity audit  findings and recommendations, including recommendations for improving  DHS’s implementation of its cybersecurity authorities and management of  federal programs to mitigate cyber risks on networks.

In developing this testimony, we relied on our previous reports, as well as  information provided by DHS on its actions in response to our previous  recommendations. We also considered information security related  information that the Office of Management and Budget reported to  Congress for fiscal year 2017. A more detailed discussion of the  objectives, scope, and methodology for this work is included in each of  the reports that are cited throughout this statement.

We conducted the work on which this statement is based in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform audits to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides such a reasonable basis for our findings and conclusions based  on our audit objectives.

Federal agencies and our nation’s critical infrastructures—such as  energy, transportation systems, communications networks, and financial  services—are dependent on computerized (cyber) information systems  and electronic data to process, maintain, and report essential information,  and to operate and control physical processes. Virtually all federal  operations are supported by computer systems and electronic data, and  agencies would find it difficult, if not impossible, to carry out their missions  and account for their resources without these information assets. Hence,  the security of these systems and data is vital to public confidence and  the nation’s safety, prosperity, and well-being. Ineffective security controls  to protect these systems and data could have a significant impact on a  broad array of government operations and assets.

Yet, computer networks and systems used by federal agencies are often  riddled with security vulnerabilities—both known and unknown. These  systems are often interconnected with other internal and external systems  and networks, including the Internet, thereby increasing the number of  avenues of attack and expanding their attack surface.

Furthermore, safeguarding federal computer systems has been a long- standing concern. This year marks the 21st anniversary of when GAO  first designated information security as a government-wide high-risk area  in 1997. We expanded this high-risk area to include safeguarding the  systems supporting our nation’s critical infrastructure in 2003 and  protecting the privacy of personally identifiable information in 2015.

Over the last several years, we have made about 2,500  recommendations to agencies aimed at improving the security of federal  systems and information. These recommendations identified actions for  agencies to take to strengthen their information security programs and  technical controls over their computer networks and systems.  Nevertheless, many agencies continue to be challenged in safeguarding  their information systems and information, in part because they have not  implemented many of these recommendations. As of March 2018, about  885 of our prior information security-related recommendations had not  been implemented.

Federal Law and Policy Provide DHS with Broad Authorities to Improve and Promote Cybersecurity

DHS has broad authorities to improve and promote cybersecurity of  federal and private-sector networks. The federal laws and policies that  underpin these authorities include the following:

The Federal Information Security Modernization Act (FISMA) of  2014 clarified and expanded DHS’s responsibilities for assisting with  the implementation of, and overseeing, information security at federal  agencies. These responsibilities include requirements to: develop, issue, and oversee agencies’ implementation of binding  operational directives to agencies, including directives for incident  reporting, contents of annual agency reports, and other  operational requirements; monitor agencies’ implementation of information security policies provide operational and technical assistance to agencies,  including by operating the federal information security incident  center, deploying technology to continuously diagnose and  mitigate threats, and conducting threat and vulnerability  assessments of systems.

Act of 2014, among other things, requires DHS to assess its  cybersecurity workforce. In this regard, the Secretary of Homeland  Security is to identify all positions in DHS that perform cybersecurity  functions and to identify cybersecurity work categories and specialty  areas of critical need.

The National Cybersecurity Protection Act of 2014 codified the  role of the National Cybersecurity and Communications Integration  Center (NCCIC)—a center established by DHS in 2009—as the  federal civilian interface for sharing information concerning  cybersecurity risks, incidents, analysis, and warnings to federal and  non-federal entities, including owners and operators of information  systems supporting critical infrastructure.

The Cybersecurity Act of 2015, among other things, sets forth  authority for enhancing the sharing of cybersecurity-related  information among federal and non-federal entities. The act gives  DHS’s NCCIC responsibility for implementing this information sharing  authority. The act also requires DHS to:  Jointly develop with other specified agencies and submit to  Congress, procedures for sharing federal cybersecurity threat  information and defensive measures with federal and non-federal  entities.

Deploy, operate, and maintain capabilities to prevent and detect  cybersecurity risks in network traffic traveling to or from an  agency’s information system. DHS is to make these capabilities  available for use by any agency. In addition, the act requires DHS  to improve intrusion detection and prevention capabilities, as  appropriate, by regularly deploying new technologies and  modifying existing technologies.

Long-standing federal policy as promulgated by a presidential  policy directive, executive orders, and the National Infrastructure  Protection Plan have designated DHS as a lead federal agency for  coordinating, assisting, and sharing information with the private-sector  to protect critical infrastructure from cyber threats.

DHS Has Acted to Improve and Promote the Cybersecurity of Federal and Private- Sector Computer Systems, but Further Improvements Are Needed

We have reviewed several federal programs and activities implemented  by DHS that are intended to mitigate cybersecurity risk for the computer  systems and networks supporting federal operations and our nation’s  critical infrastructure. These programs and activities include deploying the  National Cybersecurity Protection System, providing continuous  diagnostic and mitigation services, issuing binding operational directives,  sharing information through the National Cybersecurity and  Communications Integration Center, promoting adoption of a  cybersecurity framework, and assisting private-sector partners with cyber  risk mitigation activities. We also examined DHS’s efforts to assess its  cybersecurity workforce. DHS has made important progress in  implementing these programs and activities. However, the department  needs to take additional actions to ensure that it successfully mitigates  cybersecurity risks on federal and private-sector computer systems and  networks.

DHS Needs to Enhance Capabilities, Improve Planning, and Support Greater Adoption of Its National Cybersecurity Protection System

DHS is responsible for operating its National Cybersecurity Protection  System (NCPS), operationally known as EINSTEIN. NCPS is intended to  provide intrusion detection and prevention capabilities to entities across  the federal government. It also is intended to provide DHS with  capabilities to detect malicious traffic traversing federal agencies’  computer networks, prevent intrusions, and support data analytics and  information sharing.

In January 2016, we reported that the NCPS was partially, but not fully,  meeting most of its stated four system objectives:  Intrusion detection: We noted that NCPS provided DHS with a  limited ability to detect potentially malicious activity entering and  exiting computer networks at federal agencies. Specifically, NCPS  compared network traffic to known patterns of malicious data, or  “signatures,” but did not detect deviations from predefined baselines  of normal network behavior. In addition, the system did not monitor  several types of network traffic and its “signatures” did not address  threats that exploited many common security vulnerabilities and, thus  was not effective in detecting certain types of malicious traffic.

Intrusion prevention: The capability of NCPS to prevent intrusions  (e.g., blocking an e-mail determined to be malicious) was limited to  the types of network traffic that it monitored. For example, the  intrusion prevention function monitored and blocked e-mail. However,  it did not address malicious content from other types of network traffic.

Analytics: NCPS supports a variety of data analytical tools, including  a centralized platform for aggregating data and a capability for  analyzing the characteristics of malicious code. In addition, DHS had  further enhancements to this capability planned through 2018.

Information sharing: DHS had not developed most of the planned  functionality for NCPS’s information-sharing capability, and  requirements had only recently been approved. Moreover, we noted  that agencies and DHS did not always agree about whether  notifications of potentially malicious activity had been sent or received,  and agencies had mixed views about the usefulness of these  notifications. Further, DHS did not always solicit—and agencies did  not always provide—feedback on the notifications.

We recommended that DHS take nine actions to enhance NCPS’s  capabilities for meeting its objectives, better define requirements for  future capabilities, and develop network routing guidance. The  department agreed with our recommendations; however, as of April 2018,  it had not fully implemented 8 of the 9 recommendations. As part of a  review mandated by the Federal Cybersecurity Enhancement Act of  2015, we are currently examining DHS’s efforts to improve its intrusion  detection and prevention capabilities.

DHS Needs to Continue to Advance CDM Program to Protect Federal Systems

The Continuous Diagnostics and Mitigation (CDM) program was  established to provide federal agencies with tools and services that have  the intended capability to automate network monitoring, correlate and  analyze security-related information, and enhance risk-based decision  making at agency and government-wide levels. These tools include  sensors that perform automated scans or searches for known cyber  vulnerabilities, the results of which can feed into a dashboard that alerts  network managers and enables the agency to allocate resources based  on the risk.

DHS, in partnership with, and through the General Services  Administration, established a government-wide acquisition vehicle for  acquiring CDM capabilities and tools. The CDM blanket purchase  agreement is available to federal, state, local, and tribal government  entities for acquiring these capabilities.

There are three phases of CDM implementation and the dates for  implementing Phase 2 and Phase 3 appear to be slipping:  Phase 1: This phase involves deploying products to automate hardware  and software asset management, configuration settings, and common  vulnerability management capabilities. According to the Cybersecurity  Strategy and Implementation Plan, DHS purchased Phase 1 tools and  integration services for all participating agencies in fiscal year 2015.

Phase 2: This phase intends to address privilege management and  infrastructure integrity by allowing agencies to monitor users on their  networks and to detect whether users are engaging in unauthorized  activity. According to the Cybersecurity Strategy and Implementation  Plan, DHS was to provide agencies with additional Phase 2 capabilities  throughout fiscal year 2016, with the full suite of CDM phase 2  capabilities delivered by the end of that fiscal year. However, according to  the Office of Management and Budget’s (OMB) FISMA Annual Report to  Congress for Fiscal Year 2017, the CDM program began deploying  Phase 2 tools and sensors during fiscal year 2017.

Phase 3: According to DHS, this phase is intended to address boundary  protection and event management throughout the security life cycle. It  focuses on detecting unusual activity inside agency networks and alerting  security personnel. The agency had planned to provide 97 percent of  federal agencies the services they need for CDM Phase 3 in fiscal year  2017. However, according to OMB’s FISMA report for fiscal year 2017,  the CDM program will continue to incorporate additional capabilities,  including Phase 3, in fiscal year 2018.

In May 2016, we reported that most of the 18 agencies covered by the  CFO Act that had high-impact systems were in the early stages of  implementing CDM. All 17 of the civilian agencies that we surveyed  indicated they had developed their own strategy for information security  continuous monitoring. Additionally, according to the survey responses,  14 of the 17 civilian agencies had deployed products to automate  hardware and software asset configuration settings and common  vulnerability management.

Further, more than half of these agencies noted that they had leveraged  products/tools provided through the General Services Administration’s  acquisition vehicle. However, only 2 of the 17 agencies reported that they  had completed installation of agency and bureau/component-level  dashboards and monitored attributes of authorized users operating in  their agency’s computing environment. Agencies noted that expediting the implementation of the CDM phases could be of benefit to them in  further protecting their high-impact systems.

Subsequently, in March 2017, we reported that the effective  implementation of the CDM tools and capabilities can assist agencies in  overcoming the challenges of securing their information systems and  information. We noted that our audits often identify insecure  configurations, unpatched or unsupported software, and other  vulnerabilities in agency systems. Thus, the tools and capabilities  available under the CDM program, when effectively used by agencies,  can help them to diagnose and mitigate vulnerabilities to their systems.  We reported that, by continuing to make these tools and capabilities  available to federal agencies, DHS can also have additional assurance  that agencies are better positioned to protect their information systems  and information.

Other DHS Services Are Available to Help Protect Systems but Are Not Always Used by Agencies

Beyond the NCPS and CDM programs, DHS also provides a number of  services that could help agencies protect their information systems. Such  services include, but are not limited to:

US-CERT monthly operational bulletins, which are intended to provide  senior federal government information security officials and staff with  actionable information to improve their organization’s cybersecurity  posture based on incidents observed, reported, or acted on by DHS  and US-CERT.

CyberStat reviews, which are in-depth sessions attended by National  Security Staff, as well as officials from OMB, DHS, and an agency to  discuss that agency’s cybersecurity posture and opportunities for  collaboration. According to OMB, these interviews are face-to-face,  evidence-based meetings intended to ensure agencies are  accountable for their cybersecurity posture. The sessions are  intended to assist the agencies in developing focused strategies for  improving their information security posture in areas where there are  challenges.

DHS Red and Blue Team exercises that are intended to provide  services to agencies for testing their systems with regard to potential  attacks. A Red Team emulates a potential adversary’s attack or  exploitation capabilities against an agency’s cybersecurity posture.  The Blue Team defends an agency’s information systems when the  Red Team attacks, typically as part of an operational exercise  conducted according to rules established and monitored by a neutral  group.

In May 2016, we reported that, although participation in these services  varied among the 18 agencies we surveyed, most of those that chose to  participate reported that they generally found these services to be useful  in aiding the cybersecurity protection of their high-impact systems.  Specifically,

15 of 18 agencies reported that they participated in US-CERT monthly  operational bulletins, and most said they found the service very or  somewhat useful.

All 18 agencies reported that they participated in the CyberStat  reviews, and most said they found the service very or somewhat  useful.

9 of 18 agencies reported that they participated in DHS’ Red/Blue  team exercises, and most said they found the exercises to be very or  somewhat useful.

Half of the 18 agencies in our survey reported that they wanted an  expansion of federal initiatives and services to help protect their high- impact systems. For example, these agencies noted that expediting the  implementation of CDM phases, sharing threat intelligence information,  and sharing attack vectors, could be of benefit to them in further  protecting their high-impact systems. We believe that by continuing to  make these services available to agencies, DHS will be better able to  assist agencies in strengthening the security of their information systems.

DHS Has Issued Binding Operational Directives to Federal Agencies

FISMA authorizes DHS to develop and issue binding operational  directives to federal agencies and oversee their implementation by  agencies. The directives are compulsory and require agencies to take  specific actions that are intended to safeguard federal information and  information systems from a known threat, vulnerability, or risk.

In September 2017, we reported that DHS had developed and issued  four binding operational directives as of July 2017, instructing agencies  to: mitigate critical vulnerabilities discovered by DHS’s NCCIC through its  scanning of agencies’ Internet-accessible systems; participate in risk and vulnerability assessments as well as DHS  security architecture assessments conducted on agencies’ high-value  assets; address several urgent vulnerabilities in network infrastructure  devices identified in a NCCIC analysis report within 45 days of the  directive’s issuance; and  report cyber incidents and comply with annual FISMA reporting  requirements.

Since July 2017, DHS has issued two additional binding operational  directives instructing agencies to:  identify and remove the presence of any information security products  developed by AO Kaspersky Lab on their information systems and  discontinue the use of such products; and enhance e-mail by, among other things, removing certain insecure  protocols, and ensure public facing web sites provide services through  a secure connection.

We plan to initiate work later this year to identify and assess DHS’s  process for developing and overseeing agencies’ implementation of  binding operational directives.

DHS’s National Integration Center Generally Performs Required Functions but Needs to Evaluate Its Activities More Completely

In February 2017, we reported that NCCIC had taken steps to perform  each of its 11 statutorily required cybersecurity functions, such as being  a federal civilian interface for sharing cybersecurity-related information  with federal and nonfederal entities. NCCIC managed several programs  that provided data used in developing 43 products and services that the  center made available to its customers in the private-sector; federal,  state, local, tribal and territorial government entities; and other partner  organizations. For example, NCCIC issued indicator bulletins, which  could contain information related to cyber threat indicators, defensive  measures, and cybersecurity risks and incidents, and helped to fulfill its  function to coordinate the sharing of such information across the  government. Respondents to a survey that we administered to NCCIC’s  customers varied in their reported use of NCCIC’s products but had  generally favorable views of the center’s activities.

The National Cybersecurity Protection Act also required NCCIC to carry  out its functions in accordance with nine implementing principles, to the  extent practicable. However, as we reported, the extent to which NCCIC  adhered to the 9 principles when performing the functions was unclear  because the center had not yet determined the applicability of the  principles to all 11 functions. It also had not established metrics and  methods by which to evaluate its performance against the principles.

We also identified several impediments to NCCIC performing its  cybersecurity functions more efficiently. For example, the center did not  have a centralized system for tracking security incidents and, as a result,  could not produce a report on the status of all incidents reported to the  center. In addition, the center did not keep current and reliable customer  information and was unable to demonstrate that it had contact information  for all owners and operators of the most critical cyber-dependent  infrastructure assets.

We made nine recommendations to DHS for enhancing the effectiveness  and efficiency of NCCIC. Among other activities, these recommendations  called for the department to determine the applicability of the  implementing principles and establish metrics and methods for evaluating  performance; and address identified impediments. DHS agreed with the  recommendations; however, as of April 2018, all nine recommendations  remained unimplemented.

Additional Actions by DHS Are Needed for Promoting and Assessing Private- Sector Adoption of the Cybersecurity Framework

An executive order issued by the President in February 2013 (E.O.  13636) states that sector-specific agencies (SSA), which include DHS,  are to review the National Institute of Standards and Technology  Framework for Improving Critical Infrastructure Cybersecurity  (cybersecurity framework)  and, if necessary, develop implementation  guidance or supplemental materials to address sector-specific risks and  operating environments.

In February 2014, DHS launched the Critical Infrastructure Cyber  Community Voluntary Program to assist the enhancement of critical  infrastructure cybersecurity and to encourage adoption of the framework  across the critical infrastructure sectors. In addition, DHS, as the SSA  and co-SSA for 10 critical infrastructure sectors, had developed  framework implementation guidance for some of the sectors it leads.

Nevertheless, we reported weaknesses in DHS’s efforts to promote the  use of the framework across the sectors and within the sectors it leads.  Specifically, in December 2015, we reported that DHS did not measure  the effectiveness of cyber community voluntary program to encourage  use of the Cybersecurity Framework. In addition, DHS and GSA, which  are the co-SSAs for the government facilities sector, had yet to determine  if sector implementation guidance should be developed for the  government facilities sector. Further, in February 2018, we reported that  none of the SSAs, to include DHS, had measured the cybersecurity  framework’s implementation by entities within their respective sectors, in  accordance with the nation’s plan for national critical infrastructure  protection efforts.

We made two recommendations to DHS to better facilitate adoption of the  Cybersecurity Framework across the critical infrastructure sectors and  within the government facilities sector. We also recommended that DHS  develop methods for determining the level and type of framework  adoption by entities across their respective sectors. DHS concurred with  the three recommendations. As of April 2018, only the recommendation  related to the government facilities sector has been implemented.

DHS Needs to Better Measure Effectiveness of Cyber Risk Mitigation Activities with Critical Infrastructure Sector Partners

Presidential Policy Directive-21 issued by the President in February 2013,  states that SSAs are to collaborate with critical infrastructure owners and  operators to strengthen the security and resiliency of the nation’s critical  infrastructure.

In November 2015, we reported that the SSAs, including DHS, generally  used multiple public-private mechanisms to facilitate the sharing of  cybersecurity related information. For example, DHS used coordinating  councils and working groups of federal and nonfederal stakeholders to  facilitate coordination with each other. In addition, the department’s  NCCIC received and disseminated cyber-related information for public  and private-sector partners.

Nevertheless, we identified deficiencies in critical infrastructure partners’  efforts to collaborate to monitor progress towards improving cybersecurity  within the sectors. Specifically, the SSAs for 12 sectors, including DHS  for 8 sectors, had not developed metrics to measure and report on the  effectiveness of their cyber risk mitigation activities or their sectors’  cybersecurity posture. This was because, among other reasons, the  SSAs rely on their private-sector partners to voluntarily share information  needed to measure efforts.

We made two recommendations to DHS—one recommendation based on  its role as the SSA for 8 sectors and one recommendation based on its  role as the co-SSA for 1 sector—to collaborate with sector partners to  develop performance metrics and determine how to overcome challenges  to reporting the results of their cyber risk mitigation activities. DHS  concurred with the two recommendations. As of April 2018, DHS has not  demonstrated that it has implemented these recommendations.

DHS has taken Steps to Identify its Workforce Gaps; However, It Urgently Needs to Take Actions to Identify Its Position and Critical Skill Requirements

In February 2018, we reported that DHS had taken actions to identify,  categorize, and assign employment codes to its cybersecurity positions,  as required by the Homeland Security Cybersecurity Workforce  Assessment Act of 2014. However, its actions had not been timely and  complete. For example, DHS had not met statutorily defined deadlines  for completing actions to identify and assign codes to cybersecurity  positions or ensured that its procedures to identify, categorize, and code  its cybersecurity positions addressed vacant positions, as required by the  act. The department also had not (1) identified the individual within each  DHS component agency who was responsible for leading and overseeing  the identification and coding of the component’s cybersecurity positions or  (2) reviewed the components’ procedures for consistency with  departmental guidance.

In addition, DHS had not yet completed its efforts to identify all of the  department’s cybersecurity positions and accurately assign codes to all  filled and vacant cybersecurity positions. In August 2017, DHS reported to  the Congress that it had coded 95 percent of the department’s identified  cybersecurity positions. However, we determined that the department  had, at that time, coded approximately 79 percent of the positions. DHS  overstated the percentage of coded positions primarily because it  excluded vacant positions, even though the act required the department  to report such positions.

Further, although DHS had taken steps to identify its workforce capability  gaps, it had not identified or reported to the Congress on its department- wide cybersecurity critical needs that align with specialty areas. The  department also had not annually reported its cybersecurity critical needs  to the Office of Personnel Management (OPM), as required; and it had  not developed plans with clearly defined time frames for doing so.

We recommended that DHS take six actions, including ensuring that its  cybersecurity workforce procedures identify position vacancies and  responsibilities; reported workforce data are complete and accurate; and  plans for reporting on critical needs are developed. DHS concurred with  the six recommendations and stated that it plans to take actions to  address them by June 2018.

In conclusion, DHS is unique among federal civilian agencies in that it is  responsible for improving and promoting the cybersecurity of not only its  own internal computer systems and networks but also those of other  federal agencies and the private-sector owners and operators of critical  infrastructure. Consistent with its statutory authorities and responsibilities  under federal policy, the department has acted to assist federal agencies  and private-sector partners in bolstering their cybersecurity capabilities.

However, the effectiveness of DHS’s activities has been limited or not  clearly understood because of shortcomings with its programs and a lack  of useful performance measures. DHS needs to enhance its capabilities;  expedite delivery of services; continue to provide guidance and  assistance to federal agencies and private-sector partners; and establish  useful performance metrics to assess the effectiveness of its  cybersecurity-related activities. In addition, developing and maintaining a  qualified cybersecurity workforce needs to be a priority for the  department. Until it fully and effectively performs its cybersecurity  authorities and responsibilities, DHS’s ability to improve and promote the  cybersecurity of federal and private-sector networks will be limited.

Chairman Johnson, Ranking Member McCaskill, and Members of the  Committee, this concludes my statement. I would be pleased to respond  to your questions.

If you or your staffs have any questions about this testimony, please  contact Gregory C. Wilshusen at (202) 512-6244 or  wilshuseng@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this  statement.

GAO staff who made key contributions to this testimony are Nabajyoti  Barkakati, Chris Currie, Larry Crosland, Tammi Kalugdan, David Plocher,  Di’Mond Spencer, and Priscilla Smith.

GAO, Critical Infrastructure Protection: Additional Actions Are Essential  for Assessing Cybersecurity Framework Adoption, GAO-18-211  (Washington, D.C.: Feb. 15, 2018).

GAO, Cybersecurity Workforce: Urgent Need for DHS to Take Actions to  Identify Its Position and Critical Skill Requirements, GAO-18-175  (Washington, D.C.: Feb. 6, 2018).

GAO, Federal Information Security: Weaknesses Continue to Indicate  Need for Effective Implementation of Policies and Practices, GAO-17-549  (Washington, D.C.: Sept. 28, 2017).

GAO, Cybersecurity: Federal Efforts Are Under Way That May Address  Workforce Challenges, GAO-17-533T (Washington, D.C.: Apr. 4, 2017).

GAO, Information Security: DHS Needs to Continue to Advance Initiatives  to Protect Federal Systems, GAO-17-518T (Washington, D.C.: Mar. 28,  2017).

GAO, High-Risk Series: Progress on Many High-Risk Areas, While  Substantial Efforts Needed on Others, GAO-17-317 (Washington, D.C.:  Feb. 15, 2017).

GAO, Cybersecurity: Actions Needed to Strengthen U.S. Capabilities,  GAO-17-440T (Washington, D.C.: Feb. 14, 2017).

GAO, Cybersecurity: DHS’s National Integration Center Generally  Performs Required Functions but Needs to Evaluate Its Activities More  Completely, GAO-17-163 (Washington, D.C.: Feb. 1, 2017).

GAO, Information Security: DHS Needs to Enhance Capabilities, Improve  Planning, and Support Greater Adoption of Its National Cybersecurity  Protection System, GAO-16-294 (Washington, D.C.: Jan. 28, 2016).

GAO, Critical Infrastructure Protection: Measures Needed to Assess  Agencies’ Promotion of the Cybersecurity Framework, GAO-16-152  (Washington, D.C.: Dec. 17, 2015).

GAO, Critical Infrastructure Protection: Sector-Specific Agencies Need to  Better Measure Cybersecurity Progress, GAO-16-79 (Washington, D.C.:  Nov. 19, 2015).

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.