PILLAR II – VULNERABILITY REDUCTION DHS works to reduce organizational and systemic vulnerabilities across the federal enterprise, including our own networks, as well as other nationally critical systems and assets. Through technical capabilities, cybersecurity information, and other assistance, we empower our stakeholders to better manage their cybersecurity risks. Goal 2: Protect Federal Government Information Systems We will reduce vulnerabilities of federal agencies to ensure they achieve an adequate level of cybersecurity. DHS leads the effort to secure the federal enterprise and must use all available mechanisms to ensure that every agency maintains an adequate level of cybersecurity, commensurate with its own risks and with those of the larger enterprise. 3 While individual agencies ultimately must implement their own cybersecurity risk-management programs because they are best positioned to understand their unique mission environments, DHS works with the Office of Management and Budget (OMB) to ensure an adequate level of security enterprise-wide and to address systemic risks and interdependencies across and between agencies. DHS must also support agency efforts to reduce their vulnerabilities to cyber threats by providing tailored capabilities, tools, and services to protect legacy systems as well as cloud and shared infrastructure. Within its own systems, DHS must continue to adopt new technologies and serve as a model for other agencies in the implementation of cybersecurity best practices. In looking across the federal enterprise and in protecting its own information systems, DHS must address the greatest risks first and focus on the highest impact systems, assets, and capabilities. This means identifying the most critical systems and prioritizing protections around those systems. DHS must use cost-effective approaches that both get the most risk reduction leverage and ensure maximum return for investment. DHS must exhibit leadership through direct action and offerings, but also through collaboration with other agencies and stakeholders to pursue innovations like changes in federal information technology and procurement policies, improved analysis, and better operational planning. DHS must continue to closely collaborate with agencies including OMB, the U.S. General Services Administration, and the National Institute of Standards and Technology (NIST), as well as those responsible for protecting military and intelligence networks to deliver cybersecurity outcomes for the federal enterprise. 3 DHS’s authority to administer the implementation of agency information security policy and practices applies to systems of federal, executive-branch agencies, except for national security systems and certain Department of Defense and intelligence community systems. See 44 U.S.C. § 3553(b). 8