Objective 2.1: Increase cybersecurity of the federal enterprise through improved governance, information security policies, and oversight. To execute our statutory responsibility to administer the implementation of agency information security policies and practices, DHS must continuously assess and advocate for changes to federal information technology governance structures and government-wide policies and programs that affect cybersecurity outcomes and investments. It is necessary to further refine and clarify roles and responsibilities between OMB, DHS, and other agencies. To start, DHS must provide better support to OMB’s policy development and oversight role, and assess our own policies and programs to ensure efficiency and effectiveness. DHS must also advocate for and develop new processes to ensure accountability within agencies and across the federal enterprise in order to affect necessary cybersecurity changes. In support of these efforts, DHS must integrate information from existing protective capabilities along with relevant cybersecurity threat reporting from the intelligence community, law enforcement, and other sources to enhance the ability to understand individual agency, enterprise, and systemic risks, inform risk management decisions, and assess potential returns on investment. Driven by this information, the federal enterprise will be able to prioritize resources to meaningfully address policy and capability gaps and build a more modern, secure, and resilient information infrastructure. Sub-Objectives: a. Develop and implement a clear governance model for federal cybersecurity, including defining roles and responsibilities for legacy and cloud or shared services. b. Issue new or revised policies and recommendations as required, consistent with DHS authorities, to ensure adequate cybersecurity across the federal enterprise. c. Develop a formalized approach to measure and track agency adoption of information security policies, practices, and required controls. d. Implement processes to increase agency accountability and compliance with information security policies, practices, and required controls. e. Assess enterprise and individual agency risk posture through strategic analyses, available threat reporting, and other means to inform cybersecurity and investment priorities. f. Provide agencies with integrated and operationally relevant information necessary to understand and manage their cyber risk. Outcomes: DHS-led efforts result in agencies maintaining an adequate level of cybersecurity, commensurate with each agency’s risks and with those of the federal enterprise. 9