Chairman Ratcliffe holds hearing on Federal Cybersecurity Risk Determination

The Committee on Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection will come to order. Subcommittee is meeting this morning to receive testimony regarding how the federal government understands and manages enterprise-wide cybersecurity risks. I now recognize myself for an opening statement. As we convene today, this subcommittee is concerned that the federal government is not yet equipped to determine how threat actors seek to gain access to our private information. This challenge is one of the reasons I introduced, and yesterday, the full committee passed the Advancing Cybersecurity Diagnostics and Mitigation Act. H.R. 6443 will codify and provide direction to DHS regarding the CDM program. This was a bipartisan effort, and I thank the ranking member, Mr. Richmond, as well as Mr. Katko, Mr. Donovan, Mr. Fitzpatrick, and Mr. Langevin for working with me on this important issue, because there is an evident lack of strategy in mitigating risk across our federal agencies. Cyber workforce gaps and legacy IT systems are vulnerabilities in the federal government's cybersecurity posture, but the efficacy of our basic cybersecurity practices remain common liabilities. To this end, the Office of Management and Budget and Department of Homeland Security released a report earlier this year entitled, Federal Cybersecurity Risk Determination Report Action Plan. This report spoke to many of the challenges faced in securing enterprise-wide federal government IT systems. Perhaps not surprisingly, OMB and DHS determined that 74% of government agencies have cybersecurity programs that are either at risk or at high risk. The risk assessments performed by these agencies showed that a lack of threat information results in ineffective allocations of limited cyber resources. This overall situation creates enterprise-wide gaps in our network visibility, IT tool and capability standardization, and common operating procedures, all of which negatively impact federal cybersecurity. Given the significant and ever-increasing danger of threats and the absence of good data inventory, risk management must be fully integrated into every aspect of an organization. Leaders of federal agencies at all organizational levels must understand their responsibilities and they must be accountable for protecting organizational assets and managing security and privacy risks. The OMB and DHS report identified four main actions that are necessary to address cybersecurity risks across the federal enterprise. First, federal agencies must increase their cybersecurity threat awareness. This seems like a too obvious of a recommendation, but often those charged with defending agency networks lack timely information regarding the tactics, techniques, and procedures that our adversaries are using to exploit government information systems. Second, OMB urged agencies to standardize IT and cybersecurity capabilities to control costs and to improve asset management. Generally speaking, agencies do not have standardized cybersecurity processes, which ultimately impacts their ability to efficiently and effectively combat cyber threats. The Continuous Diagnostics and Mitigation Program, or CDM, will accelerate both IT management efforts and cybersecurity improvements across the federal government. In fact, my bill, the Advancing Cybersecurity Diagnostics and Mitigation Act, will require the program to evolve, thereby ensuring that agency CIOs and DHS have the visibility necessary not only to combat threats, but also to target modernization resources and efforts where they are most needed. The third recommended action is that agencies must consolidate their security operation centers to improve incident detection and response capabilities. OMB found that only 27% of agencies can detect and investigate attempts to access large volumes of data. This troubling statistic should cause us all to pause. While the report identifies that federal agencies currently lack network visibility, DHS's CDM program can assist with this issue by providing insight into what is occurring on networks. After all, you can't defend what you can't see. And finally, OMB recommended that agencies increase accountability through improved governance processes. Indeed, both the Federal Information Security Management Act and President Trump's executive order on strengthening the cybersecurity and federal networks and critical infrastructure already identify the agency head as the official ultimately responsible for each agency's cybersecurity. Of course, agency heads often delegate cyber risk management responsibilities to the chief information officer and chief information security officer. But agency leadership should increase its oversight of and its engagement in their agency's cybersecurity ecosystem. Ultimately, a collaborative approach to mitigating cyber threats is meant to prioritize meeting the needs of DHS's partners and is consistent with the growing recognition among government, academic, and corporate leaders that cybersecurity is increasingly interdependent across sectors and must be a core aspect of risk management strategies. We are in an era that requires flexibility, resiliency, and discipline. And I look forward to a candid conversation with our witnesses today about ensuring our federal networks can embody these goals. Your thoughts and opinions are important as we oversee the state of federal government cybersecurity risks.