Title page

Contents

Highlights 2

Background 4

GAO Has Previously Identified Four Major Cybersecurity Challenges Facing the Nation 6

Federal Law and Policy Establish Requirements for Critical Infrastructure 6

DHS Actions Urgently Needed to Protect Critical Infrastructure 9

DHS Needs to Strengthen Its Role in Protecting the Cybersecurity of Critical Infrastructure 9

CISA Should Improve its Priority Setting Efforts 12

GAO Contact and Staff Acknowledgments 18

Figure 1. Examples of Critical Infrastructure 5

Figure 2. Cybersecurity and Infrastructure Security Agency (CISA) Coordination Challenges Reported by Stakeholders Representing the 16 Critical... 11

Figure 3. Cybersecurity and Infrastructure Security Agency (CISA) National Critical Functions 16