Stakeholders in most critical infrastructures have had issues coordinating with the federal agency charged with assisting the public and private sectors with cyber and infrastructure security, including a lack of timely responses to requests and inconsistencies with information sharing, the Government Accountability Office (GAO) said in a report this week.
GAO identified five areas of challenges for these stakeholders, including a lack of insight about the Cybersecurity and Infrastructure Security Agency’s (CISA) organizational structure and who they should work with in the agency, not being included early on in the development of guidance for stakeholders, taking too long to get requested information and data, not always getting information from CISA that the agency intended to share with a sector or sectors, and a lack of access to actionable information.
CISA officials told the GAO that giving private sector entities access to actionable intelligence is a “perennial challenge” and the agency provided examples of its efforts to distribute classified and declassified information. GAO said that while “an ongoing issue,” CISA is working to address the challenge.
Regarding being able to get information more quickly to stakeholders, CISA said it is developing a workflow mechanism to track inquires the agency receives and plans on more “timely briefings” to stakeholders. GAO said that if CISA implements these initiatives they will address stakeholder concerns.
As for engaging with stakeholders earlier in the development of guidance relevant to a sector, CISA officials told the GAO they routinely work with stakeholders on guidance but noted that “there seems to be an increasing expectation from stakeholders that their input will be ‘operationalized’ and that they will have greater levels of input from the very beginning of guidance development,” the report said.
GAO said that more consistent engagement with its stakeholders could improve the guidance that CISA develops for each sector.
The GAO released the report on Wednesday.