Building a Resilient Railway Infrastructure

2021 has been chosen as the European Year of Rail by the European Commission. The European initiative aims to highlight the benefits of rail as a sustainable, smart and safe means of transport to support the delivery of its European Green Deal objectives in the transport field.
Cybersecurity is a key requirement to enable railways to deploy and take advantage of the full extent of a connected, digital environment.
However, European infrastructure managers and railway undertakings face a complex regulatory system that requires a deep understanding of operational cybersecurity actions. In addition, European rail is undergoing a major transformation of its operations, systems and infrastructure due to digitalisation, mass transit and, increasing interconnections. Therefore, the implementation of cybersecurity requirements is fundamental for the digital enhancement and security of the sector.
ENISA, the EU Agency for Cybersecurity, and ERA, the EU Agency for Railways, have joined forces to organise a virtual Conference on Rail Cybersecurity.
Policy
The European Commission has proposed the revision of the Network Information Security Directive (NIS2) to strengthen the cybersecurity measures to be adopted by the Member States and applied, among others, by European railway undertakings (RU) and infrastructure managers (IM).
The European Commission’s Directorate-General for Mobility and Transport (DG MOVE) also encourages awareness-raising of railway stakeholders by promoting the use of its Land Transport Security platform. A cybersecurity toolkit was also developed and shared with the participants. Cybersecurity is now a major concern for National Safety Authorities. The French rail safety authority, l’établissement public de sécurité ferroviaire (the EPSF) compiled the related challenges in a white paper, jointly with the French IM and main RU, the French Cybersecurity Agency, ANSSI and ERA.
Standardisation & Certification
The Working Group 26 of the European Committee for Electrotechnical Standardisation (CENELEC) delivered the promising Technical Specification 50701 on cybersecurity for railways, now under review by the National Committees. A published version of the technical specification is expected before the summer. A voluntary reference to this standard will be made through the application guides developed by ERA. Railway stakeholders expect the technical specification to lay the foundations of a common risk analysis methodology. As demonstrated by the case study proposed by the Italian railway stakeholders, such methodology will link the security analysis to the safety case.
Research & Innovation
Shift2Rail the Joint Undertaking has gained maturity, and the Technical Demonstrator 2.11 on cybersecurity will soon demonstrate the applicability of their findings on specific projects such as Automatic Train Operation or Adaptable Communication Systems.
Technical interoperability standards for EU railway automation are being proposed for consideration in the railway regulatory framework, proposing "secure by design" shared railway services. In addition, The International Union of Railways (UIC), recently launched a Cyber Security Solution Platform, taking a pragmatic approach in building a solutions catalogue to risks and vulnerabilities identified by railway users.
Information Sharing & Cooperation
The European Railway-ISAC is attracting an increasing number of participants willing to share concerns or even vulnerabilities to trusted members and ensuring a collective response to the cybersecurity challenge. An open call by Shift2Rail, namely the 4SECURERAIL project, is developing a proposal for a European Computer Security Incident Response Team, allowing for identified threats to be instantly shared with targeted railway stakeholders.
With such developments, the railway industry, represented by the European Rail Industry Association (UNIFE), discussed how ready the sector is to increase the level of cybersecurity. UNIFE highlighted several priorities, such as: the approval and usage of the TS 50701, the need for adequate certification schemes on product level,the need for specific protection profiles on interface-specific devices and subsystems. This would allow for a more harmonized approach for manufacturers and system integrators.
Conclusions
The participants voted topics for future conferences and these include, among others:
- new technologies;
- cyber risk management for railways;
- cyber threat landscape;
- the update of Technical Specifications for Interoperability (TSI);
- cyber skills and training and cyber incident response.
Both agencies are paying very close attention to all the developments in the field of railway cybersecurity.
The success of the online conference of the last two days shows how railway stakeholders can benefit from close cooperation to ensure that both the cybersecurity and the railway regulatory framework are cross-fertilised.

When & How to Report Security Incidents - ENISA releases new guidelines

The European Union Agency for Cybersecurity (ENISA) releases new guidelines to facilitate the reporting of security incidents by national telecom security authorities.
The guidelines published help national telecom security authorities in the reporting of significant incidents to ENISA and the European Commission under the European Electronic Communications Code (EECC).
These new guidelines replace the previous ones issued by ENISA on incident reporting under Article 13a of the EU Telecoms Framework Directive. This revised version takes into account the scope and the provisions of the EECC and provides non-binding technical guidance to national authorities supervising security in the electronic communications sector.
The following three types of incident reporting are provided for under article 40 of the EECC:
1. National incident reporting from providers to national security authorities;
2. Ad-hoc incident reporting between national security authorities and ENISA;
3. Annual summary reporting from national security authorities to the European Commission and ENISA.
The new guidelines focus firstly on the ad-hoc incident reporting between the security authorities and ENISA and secondly on the annual summary reporting. More specifically, the document includes information on how and when security authorities can report security incidents to ENISA, to the European Commission and to other security authorities.
The information provided considers the services and incidents within the scope of the EECC - incidents affecting confidentiality, availability, integrity and authenticity of networks and services.  The thresholds needed for the annual reporting are also defined.  These thresholds are both of a quantitative and of a qualitative nature.
The quantitative elements considered include the number of users affected and the duration of the incident. Qualitative information was also used, such as the geographical coverage of the incident and the impact on the economy, on society and on users.
The new guidelines also include an incident report template and draw the distinction between national and annual reporting.
This report was drafted by ENISA in close cooperation with the ECASEC expert group of national telecom security authorities.

How science can help build a more resilient Europe

Enhanced data collection, more knowledge sharing and a long-term approach to risk will be key in strengthening Europe’s resilience against future disasters, according to a new book published today by the JRC.
Drawing lessons from the coronavirus pandemic and other crises, ‘Science for Disaster Risk Management 2020: acting today, protecting tomorrow’ explores how to protect lives, livelihoods, the environment and our rich cultural heritage from future disasters.
With input from over 300 experts, the book highlights the important role of science in preparing Europe to face the challenges that lie over the horizon.
Commissioner for Crisis Management, Janez Lenarčič, said: “As disasters defy borders the EU supports national action and promotes cross-border cooperation on disaster risk management – with the EU Civil Protection Mechanism being at the heart of this work. Using all data, science and lessons learnt available is vital to strengthen the collective safety and resilience against disasters in the EU and beyond”.
Commissioner for Innovation, Research, Culture, Education and Youth, Mariya Gabriel said: “The Joint Research Centre has long held key expertise in disaster risk management, spawning valuable tools like early warning systems and satellite mapping services, disaster risk studies and global risk models. The new book ‘Science for Disaster Risk Management 2020: acting today, protecting tomorrow’, is the latest of these tools: it shows how vital science is in helping us prepare for disasters, and how we can all work together to learn the lessons of the past and prepare better for the future.”
The aftermath of disasters can be learning opportunities, both in recovering quickly and dealing with the underlying drivers of disaster risk to avoid or mitigate similar events. This new book provides several examples and recommendations on how to grasp these opportunities to build a more resilient future.
Data is key to understanding the impact of disasters, and better managing them in the future
Events like the Fukushima accident in 2011 or the coronavirus pandemic show that, however improbable they may seem, disasters do occur and they can have a huge impact.
On a practical level, past disasters can serve to highlight weaknesses and trigger changes in the policy framework. For example, the forest fires of 2017 in Portugal caused a reassessment of fire management policies and led to new legislation to protect people and territory from forest fires.
To make the most of these opportunities, scientists need quality, comprehensive data and information gathered after a disaster to develop the right methodologies and tools. The book authors recommend developing a mechanism so that disaster loss data can be collected and used in this way.
A major challenge to collating and using data is that much of the damages and loss to cultural and environmental ecosystems caused by disasters can remain hidden when the value of these assets are not easy to define in economic terms.
It is hard to put a price on cultural artefacts or quantify what is lost when certain oral traditions and customs are no longer performed.
As a first step, the authors recommend compiling an inventory of the current state of cultural heritage assets in Europe, which can contribute to preserving that heritage in the face of disasters.
Taking a long-term view on disaster risk
The book also calls for a shift from a short-term, reactionary approach to disaster risk management, towards a long-term view that tackles the underlying drivers of risk - such as inequality, urbanisation, or climate change.
For example, the authors show how urban planning can play a key role in avoiding building in risk-prone areas like flood plains. Climate change also poses a challenge that requires a long-term response: sectors like European agriculture will need to deal with more frequent and extreme weather events in the coming years.
The book recommends actions such as supporting research groups from across different scientific disciplines to work together to find nature-based innovative solutions to societal challenges.
Sharing knowledge and working together to become more resilient
In today’s complex world and the many links between assets, sectors and governance levels, disasters often have an impact across countries and sections of society. It is therefore necessary that different stakeholders and groups share their data and knowledge to co-create effective strategies to reduce disaster risk.
One positive example of this came following the explosion of a fertiliser plant near Toulouse in 2001. It triggered a set of actions to engage local stakeholders in the co-design of strategies and measures to deal with technological risk.
By establishing local committees for information and consultation, people can now participate in the decision-making process and implementation of measures to prevent these risks, while also having an influence on land-use planning.
The book recommends education and training to raise awareness and build the capacity of individuals and communities to contribute to these efforts.

New EU tool to support the assessment of wildfire risks and the mitigation of effects in Latin America and Caribbean region

The Joint Research Centre has developed country profiles under the Global Wildfire Information System (GWIS) helping to support wildfire management and disaster risk reduction globally but in particular, in the Latin American and Caribbean (LAC) region.
These profiles provide information on the geographic distribution of wildfires, burnt areas and emissions, and assess wildfire regimes and impacts at country and sub-country level for all continents worldwide.
Commissioner for Innovation, Research, Culture, Education and Youth, Mariya Gabriel, said: "Wildfires can have catastrophic consequences on the environment and on people. The country profiles designed by the Joint Research Centre will contribute to the risk assessment and mitigation of this danger, proving how science can help improve and protect lives and our planet."
Mette Wilkie, Director of the Forestry Division, FAO said:
"The opportunity for countries around the world to assess their national fire situation through the Wildfire Country Profiles of GWIS is fundamental to understanding fire risk and underpinning plans to mitigate the effects of wildfires. These efforts are critical to the achievement of Sustainable Development Goals related to climate change mitigation, biodiversity conservation and sustainable livelihoods. FAO looks forward to continuing collaboration with the EC through JRC and GWIS, particularly in Latin America and the Caribbean."
Leo Heileman, UN Environment Programme's Regional Director for Latin America and the Caribbean said:
"UNEP is delighted to support, along with FAO, a new information system that will improve wildfire management and strengthen disaster risk reduction in Latin America and the Caribbean, including the Amazon region. This kind of initiatives are part of an upgraded framework of cooperation agreed in February 2021 between the European Commission and UNEP aimed to step up efforts to tackle the climate, biodiversity and pollution crises, thus supporting countries build a healthier and more inclusive and resilient future for all."
Steven Ramage, Head of External Relations at the GEO Secretariat said:
"The Group on Earth Observations (GEO) welcomes the development of the GWIS country profiles by the European Commission’s Joint Research Center (JRC). This application is a unique resource to enhance wildfire prevention, preparedness and effectiveness in wildfire management. It provides access to critical wildfire information for governments and practitioners alike to prepare and respond to natural hazards.
GWIS is one of the most successful collaborative initiatives within the GEO Work Programme, providing Earth observations data and tools to enable informed national responses in the context of the Sendai Framework for Disaster Risk Reduction and the Paris Agreement on climate change."
This information is essential to allow a global assessment of wildfire risk and to mitigate the effects of wildfires on land degradation, deforestation, or biomass burning emissions.
They contribute to shaping appropriate policies, reducing community exposure, mitigating damage and increasing resilience to wildfire events. These GWIS services also contribute to the implementation of Sustainable Development Goals (SDGs), reducing the impact of climate change and disaster risk.
These country profiles are part of the new European Commission initiative to support wildfire management and disaster risk reduction globally and in particular in Latin America and the Caribbean.
This JRC action will fit into a comprehensive approach by the EU to support conservation and sustainable development of the Amazon forests.
There are at present more than 50 EU programmes on this regional priority, and the new budget for global Europe will also cover a specific Amazon strategy, coordinated with EU Member States.
This will be implemented in collaboration with the EU Delegations in the LAC region, supporting forthcoming EU programs in the region under the EU Green Deal strategy.
Through a Team Europe Initiative for the Amazon basin, coordinated actions in the field of forest conservation, sustainable agriculture, and environmental governance, will strengthen the impact and use of the GWIS services.

Space ISAC Announces Initial Operating Capability for Threat Information Sharing

The Space Information Sharing and Analysis Center (Space ISAC) has announced a significant milestone, declaring the organization has reached Initial Operating Capability (IOC) following the launch of Space ISAC’s member portal and threat intelligence sharing platform. This capability will serve as the first of its kind, enabling commercial industry and international space partners to share timely, actionable information about space-based threats.
This milestone event marks just over one year since Space ISAC’s board of directors and leaders from U.S. government agencies met to discuss the timeline to achieve initial operating capability.
“Achieving IOC for the Space ISAC is one of the most critical milestones toward protecting the space critical infrastructure for the global space community. This platform for information sharing will bring our community together and align our efforts to increase the security and reliability of space systems,” said Frank Backes, Senior Vice President, Kratos Federal Space and Chairman of the Board at Space ISAC.
Space ISAC has selected Cyware to host the Space ISAC portal and threat intelligence sharing platform. The platform allows Space ISAC members to share threat data securely with next-generation partnership capabilities that meet the needs of the space industry’s rapidly evolving threat environment.
“Our team at Cyware believes it is mission-critical to support and empower cybersecurity sharing communities with the tools and resources needed to collaborate and share intelligence to improve security operations and maintain resiliency,” said Anuj Goel, CEO and co-founder of Cyware. “We are impressed by Space ISAC’s dedication to improving the defense capabilities of their membership. They are consistently seeking out the best opportunities to enhance threat intelligence sharing in an integrated and collaborative manner, that reduces cyber risk across space and other key industries where intelligence is critical.”
“It’s incredibly exciting to see the introduction of such a platform where commercial industry and international space partners will soon be able to share timely information about space-based threats,” said William O. Ferguson, Cyber Security Operations Manager for founding board member SES.
Space ISAC consists of 24 members and counting from the global space community. Johns Hopkins Applied Physics Lab, a founding board member of Space ISAC, leads a Space ISAC team that vets all new members to ensure that Space ISAC maintains the highest levels of trust and integrity within its membership base.
“We are thrilled to reach this milestone, a giant step in making all of us together smarter and safer than any of us alone. I hope that many others will join us in ensuring the resilience of the global space enterprise,” said Michael Ryschkewitsch, Head, Space Sector at Johns Hopkins Applied Physics Laboratory.
Andre Adelsbach, vice president of Group Information and Cyber Security for SES, added, “At SES, we realize the importance of safeguarding current and emerging space service technology, and welcome efforts that can be developed across the industry.”
Additionally, Space ISAC’s IOC includes hosting member events and facilitating working groups and task forces. These initiatives have created opportunities for Space ISAC members and partners to develop the functions of the ISAC and raise the entire space sector’s security posture. This includes an information sharing work group, an analyst work group, and task forces dedicated to small satellites and Space Policy Directive-5.
“As an ISAC we are responsible to coordinate across the entire space sector and communicate critical information sharing far and wide and for global space to create sector-wide situational awareness,” said Erin Miller, Executive Director, Space ISAC.

IAEA Develops New Benchmarks for Computational Methods for Utilization, Operation and Safety Analysis of Research Reactors

Under a recently completed IAEA project, experts have developed a benchmark database for computational methods and tools used for the utilization, operation and safety analysis of research reactors.
A benchmark in this context is an experiment conducted in a research reactor, including the measured data and sufficient details about the research reactor and the experimental facility.
“The benchmark allows modelling the experiment using a computer code,” said Frances Marshall, the lead officer of the four-year IAEA coordinated research project (CRP). “The results of the calculations are compared with the data to assess whether the code and the modelling done are adequate for the case under study.”
Benchmarking computational codes and methods against experimental data is key to assessing the validity of the codes’ application to the design, operation, utilization and safety analysis of research reactors.
The benchmarks can be used to:
- train new professionals in research reactors by allowing them to develop their modelling skills using well-documented cases (benchmarks);
- improve modelling requiring advanced code functions and user knowledge;
- conduct formal validation of codes, models or user qualifications.
The CRP benchmarked many of the most common research reactor codes used at international level, and demonstrated that the codes, methods and the nuclear data available yield results that, in the majority of cases, meet the operational requirements of research reactor facilities.
The collected data will be used to update the IAEA’s Research Reactor Benchmarking Database: Facility Specification and Experimental Data, which is a valuable resource for assisting the optimization of research reactor core management and experimental programmes, while maintaining safety.
The project was carried out by several research reactor operating organizations with ongoing irradiation and measurement activities in fuel burnup and material and target activation. The participants provided experimental data and research reactor facility specifications covering a broad range of research reactor types and power levels. The quality of the data was assessed by an independent review to confirm its use as benchmarks, leading to the establishment of 14 benchmark specifications using data from nine different research reactors. Calculations were then made by at least two participants for each of the benchmarks, using a wealth of codes, leading to a total of 53 analysis contributions.
The overall objective of the CRP was to encourage cooperation, foster the exchange of information and increase the knowledge and expertise in numerical analysis to improve the design, operation, utilization, safety and decommissioning of research reactors, in particular in fuel multicycle depletion analysis, and material and target activation calculations.

ENISA provide statement on Microsoft Exchange vulnerabilities

The EU Agency for Cybersecurity (ENISA) has provided a statement with an assessment and advice on Microsoft Exchange vulnerabilities.
Microsoft released security updates for Microsoft (MS) Exchange server suite. Active exploitation has been observed on-premises running MS Exchange installations.
MS Exchange vulnerabilities once exploited may lead to network compromise, data exfiltration and ransomware attacks. Across the EU, an increasing number of MS Exchange installations have also been found to be the target of malicious attacks.
ENISA published a situation report which provides an assessment as well as advice and mitigation measures. It reports that threat has been assessed as severe and considers these types of attacks probable and of high risk.
The Agency calls on organisations using affected Microsoft Exchange versions to patch the flaws immediately and thoroughly investigate for potential signs of compromise.
At EU level, the EU CSIRTs Network and EU Cyber Crises Liaison Organisation Network (CyCLONe) are monitoring the situation and collecting information at both the technical and operational levels.
Microsoft is updating advisories and guidance while additional technical information and advice are provided by CERT-EU technical advisory.

CISA Publish Ransomware Guidance and Resources

Ransomware is an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. In recent years, ransomware incidents have become increasingly prevalent among the Nation’s state, local, tribal, and territorial (SLTT) government entities and critical infrastructure organizations.
Malicious actors continue to adjust and evolve their ransomware tactics over time, and CISA analysts remain vigilant in maintaining awareness of ransomware attacks and associated tactics, techniques, and procedures across the country and around the world: See CISA's Awareness Briefings on Combating Ransomware, Joint Ransomware Statement, and CISA Insights – Ransomware Outbreak.
Looking to learn more about this growing cyber threat? The NEW Ransomware Guide is a great place to start. The Guide, released in September 2020, represents a joint effort between CISA and the Multi-State Information Sharing and Analysis Center (MS-ISAC). The joint Ransomware Guide includes industry best practices and a response checklist that can serve as a ransomware-specific addendum to organization cyber incident response plans.
In January 2021, CISA unveiled the Reduce the Risk of Ransomware Campaign to raise awareness and instigate actions to combat this ongoing and evolving threat. The campaign is a focused, coordinated and sustained effort to encourage public and private sector organizations to implement best practices, tools and resources that can help them mitigate ransomware risk.

UNISDR Report: Words into Action guideline: Man-made/technological hazards

The UNISDR has issues a report that takes a practical approach in addressing man-made and technological hazards, and builds upon previous analyses and recommendations relating to such hazards in the context of DRR.
The number and magnitude of man-made disasters worldwide have risen since the 1970s and continue to grow in both frequency and impact on human wellbeing and economies, particularly in low and middle-income countries.
Several major technological accidents and the increased number of new hazardous substances and materials have highlighted the need to tackle these hazards within the overall frame of inclusive disaster risk management. Paragraph 15 of the Sendai Framework for Disaster Risk Reduction 2015-2030 leaves no doubt about the need to address hazards comprehensively as it applies to the risk of small-scale and large-scale, frequent and infrequent, sudden and slow-onset disasters, caused by both natural and man-made hazards as well as related environmental, technological and biological hazards and risks. It aims to guide the management of disaster risk at all levels as well as within and across all sectors.
The United Nations Office for Disaster Risk Reduction (UNISDR) is the focal point of the United Nations system for disaster risk reduction and the custodian of the Sendai Framework, supporting countries and societies in its implementation, monitoring and review of progress.
In accordance with the Sendai Framework, this guide seeks to address man-made hazards by strengthening national and local disaster management plans to include these hazards and by raising awareness of their risks and impacts. Furthermore, it will be a valuable tool to support training and capacity building.
This guide provides a set of evidence-based, practical activities for implementation for chemical, industrial and transport accidents, and nuclear and radiological hazards under the Sendai Framework’s four priorities for action. The guide highlights the existing diversity of thematic frameworks, institutional and legal mechanisms at global and regional levels that are related to and used for addressing man-made hazards. It also draws attention to existing collaborations within the disaster risk reduction community and key partners.
The Guide builds on the outcomes of the Open-ended Intergovernmental Expert Working Group on Indicators and Terminology for the Sendai Framework, and the work on hazard classification and terminology related to man-made hazards.
Full guide is available here >>

GAO Report: Opportunities Exist for DOE to Better Support Utilities in Improving Resilience to Hurricanes

Hurricanes are a leading cause of major power outages in the U.S., impacting millions of customers in recent years. Utilities in hurricane-affected states have invested in ways to better equip their grids to withstand and rapidly recover from hurricanes. For example, some utilities have elevated equipment to protect grid infrastructure from flooding.
The Department of Energy and its National Laboratories are developing planning tools, such as metrics to track grid resilience. However, we recommended that DOE create a plan to better guide these efforts and to better inform utilities about available resources at its National Labs.
Since 2012, utilities have taken steps to improve grid resilience to severe hurricanes, such as (1) implementing storm hardening measures to enable the grid to better withstand the effects of hurricanes; (2) adopting technologies to enhance operational capacity and help quickly restore service following disruptions; and (3) participating in mutual aid programs with other utilities and training and planning exercises. For example, utilities have implemented storm hardening measures that include elevating facilities and constructing flood walls to protect against storm surges. Utilities have also adopted technologies that enhance communication capabilities and monitor systems to detect, locate, and repair sources of disruptions. However, these utilities reported challenges justifying grid resilience investments to obtain regulatory approval, and some utilities have limited resources to pursue such enhancements.
Various federal agencies can provide funding for efforts to enhance grid resilience to hurricanes, including the Department of Agriculture (USDA) and the Federal Emergency Management Agency (FEMA). However, eligibility for most federal funding for grid resilience, including some USDA and FEMA funding, is limited to publicly owned utilities and state, tribal, and local governments. The Department of Energy (DOE) does not provide direct funding for grid resilience improvements, but it has efforts under way, including through its National Laboratories, to provide technical assistance and promote research and collaboration with utilities. DOE has also initiated preliminary efforts to develop tools for resilience planning, including resilience metrics and other tools such as a framework for planning, but DOE does not have a plan to guide these efforts. Without a plan to guide DOE efforts to develop tools for resilience planning, utilities may continue to face challenges justifying resilience investments. In addition, DOE lacks a formal mechanism to inform utilities about the efforts of its National Laboratories. Such a mechanism would help utilities leverage existing resources for improving grid resilience to hurricanes.
Hurricanes pose significant threats to the electricity grid in some U.S. coastal areas and territories and are a leading cause of major power outages. In recent years, hurricanes have impacted millions of customers in these areas. Adoption of technologies and other measures could improve the resilience of the grid so that it is better able to withstand and rapidly recover from severe weather; this could help mitigate the effects of hurricanes.
This report examines (1) measures utilities in selected states have adopted to enhance grid resilience following major hurricanes since 2012 and any challenges utilities face funding such measures; and (2) federal efforts to support the adoption of measures to enhance grid resilience to hurricanes and any opportunities that exist to improve these efforts. For this report, GAO assessed agency and industry actions; reviewed relevant reports, policies, and documents; and interviewed federal, industry, and local officials.
GAO recommends that DOE (1) establish a plan to guide its efforts to develop tools for resilience planning, and (2) develop a mechanism to better inform utilities about grid resilience efforts at the National Laboratories. DOE agreed in principle with these recommendations, but its proposed actions do not fully address GAO's concerns.
Full report can be found here >>
1 30 31 32 33 34 50