GAO Examines Federal Response To Cybersecurity Incidents

In a new report, the GAO examined federal responses to two cybersecurity breaches: the hack of SolarWinds and the exploitation of a vulnerability in Microsoft Exchange.

The GAO stated that both incidents were caused by foreign government actors: the SolarWinds breach was by the Russian Foreign Intelligence Service and the Microsoft Exchange breach was by the Chinese Ministry of State Security. The report (1) provided a summary of the incidents, (2) described steps that federal agencies have taken in response to these incidents, and (3) identified lessons learned by federal agencies from these incidents.

GAO noted that federal agencies (i) formed two Cyber Unified Coordinated Groups (or "UCGs"), one for each incident, whose efforts included issuing directives and providing guidance and tools to agencies, and (ii) reported to the Cybersecurity and Infrastructure Security Agency the actions they took to mitigate the threats from these incidents. GAO said that federal