Objective 2.2: Provide protective capabilities, tools, and services across the federal enterprise. DHS operates enterprise-wide capabilities and offers tools and services to assist agencies manage their cybersecurity risks. Certain elements of the federal enterprise must be further centralized to appropriately and consistently address key cybersecurity risks and provide improved enterprisewide security. For example, DHS has made significant progress in establishing baseline protective capabilities across the federal enterprise through the deployment of perimeter security capabilities. DHS will establish additional capabilities to cost-effectively address key cybersecurity risks across the federal enterprise and to address increasing use of cloud infrastructure and shared services. DHS must also build on economic and operational efficiencies through the centralized purchase or in-house development of tools and services, where appropriate, to address threats to legacy systems and cloud or shared services. New tools and services may be offered to agencies on a reimbursable basis or without reimbursement when they provide needed capability to agencies, address priority threats, or are necessary to facilitate situational awareness, incident response, or other strategic goals. Sub-Objectives: a. Identify elements of the federal enterprise that should be centralized to cost-effectively address key cybersecurity risks and provide enterprise security. b. Deploy, where appropriate, centralized protective capabilities to address enterprise-wide cybersecurity risk. c. Develop and provide additional cybersecurity tools and services for agencies in response to emerging or identified threats. d. Create performance metrics to measure the effectiveness of new and existing cybersecurity capabilities, tools, and services. Outcomes: Federal agencies utilize DHS capabilities, tools, and services to identify and mitigate cyber threats and vulnerabilities before they do significant harm. Objective 2.3: Deploy innovative cybersecurity capabilities and practices to protect DHS information systems. DHS must maintain an adequate level of security for our own systems. Many DHS information systems remain largely decentralized and are operated by Components without a standardized cybersecurity approach or methodology. DHS must undertake a systematic effort to assess our information systems at greatest risk, and to ensure that appropriate protective capabilities and methodologies are in place to secure sensitive information while enabling critical mission functions. DHS must adopt a more unified approach to securing our own information systems and, where appropriate, deploy standardized, cost-effective, and cutting-edge capabilities across high-value departmental information systems. As we increasingly leverage cloud and shared services, DHS must continue to develop and pilot emerging capabilities, tools, and practices to more effectively detect and mitigate evolving threats and vulnerabilities in a timely fashion and ensure that our cybersecurity approaches are flexible and dynamic enough to counter determined and creative adversaries. DHS must serve as a first adopter and model for other agencies as we work to modernize our information technology and the entire federal enterprise. 10