Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Short answer: The U.S. Government Accountability Office (GAO) says the nation’s cybersecurity problem has four connected dimensions: federal strategy and oversight, federal systems, critical infrastructure, and privacy and sensitive data. Its June 13, 2024, GAO-24-107231 report organizes those challenges into 10 actions, from national strategy and software supply chains to incident response, artificial intelligence, privacy, and consent.
This is a federal oversight agenda, not a recommendation to buy one security product. The report measures progress through agency performance, government-wide coordination, critical-infrastructure protection, and implementation of GAO recommendations.
What GAO-24-107231 examines
GAO has treated information security as a government-wide High-Risk area since 1997. It expanded that designation in 2003 to include the cybersecurity of critical infrastructure and in 2015 to include privacy of personally identifiable information. The 2024 report updates the four challenge areas established in GAO’s 2018 work.
Free tools Windows power users keep installed
One-click scans. No signup required.
Its objective was to describe federal cybersecurity challenges and progress, summarize related GAO work, assess recommendation implementation, and identify ongoing and planned work across the 10 actions. Federal agencies and critical-infrastructure operators rely on technology for essential operations and information; failures can affect human safety, national security, the environment, the economy, privacy, and national well-being.
#1 Best Overall
GAO emphasizes that threats differ in source, capability, willingness to act, and motive. The report therefore treats cybersecurity as a connected governance problem rather than a single technical control.
The four major cybersecurity challenges
| Challenge area | What it covers | Associated actions |
|---|---|---|
| Strategy and oversight | National direction, supply-chain risk, workforce capacity, and emerging technology | 1–4 |
| Federal systems and information | Government-wide initiatives, agency information-security programs, and incident response | 5–7 |
| Critical infrastructure | The federal role in protecting systems such as electricity and telecommunications | 8 |
| Privacy and sensitive data | Protecting information and limiting its collection and use | 9–10 |
The four areas overlap. For example, a national strategy must address workforce and supply chains, while agency systems and critical infrastructure both hold sensitive information. GAO presents the 10 actions as a connected agenda for oversight and operations.
The 10 actions GAO identifies
1. Build and execute a comprehensive national cybersecurity strategy
Federal leaders need a strategy that covers national cybersecurity and the country’s role in global cyberspace. The action concerns execution as well as publication: responsibilities, priorities, coordination, and measures of progress must be clear enough for oversight.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall2. Reduce global software and hardware supply-chain risks
Supply-chain exposure includes the possibility that malicious software or hardware is installed before a product reaches an agency or operator. The action calls for federal approaches that identify, manage, and reduce those risks across suppliers and technologies.
3. Address cybersecurity workforce-management problems
Agencies need the people and management practices required to operate, secure, and oversee complex systems. GAO treats workforce planning as a structural cybersecurity issue, not merely a hiring exercise.
4. Secure emerging technologies, including AI and the Internet of Things
New technologies can expand capability while introducing unfamiliar attack paths, data exposures, and oversight questions. GAO specifically includes artificial intelligence and Internet of Things devices in the security agenda.
5. Improve implementation of government-wide cybersecurity initiatives
Government-wide programs only reduce risk when agencies implement them consistently and oversight can verify results. This action focuses on turning common federal requirements and initiatives into dependable practice.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →6. Correct weaknesses in agency information-security programs
Each agency must address weaknesses in its own information-security program, including governance, controls, testing, and remediation. GAO’s framing keeps agency accountability alongside government-wide coordination.
7. Strengthen the federal response to cyber incidents
Federal incident response must support timely detection, reporting, coordination, containment, recovery, and lessons learned. The action is about the government’s ability to respond as a system, not just an individual agency’s playbook.
8. Strengthen the federal role in critical-infrastructure cybersecurity
GAO calls for a stronger federal role in protecting critical infrastructure, including electricity grids and telecommunications networks. The challenge is national because disruptions can cross agency, state, sector, and geographic boundaries.
9. Improve protection of privacy and sensitive data
Federal efforts must protect personally identifiable information and other sensitive data throughout its lifecycle. Privacy is treated as a cybersecurity and governance responsibility, not as a separate compliance afterthought.
10. Limit personal-information collection and use, with knowledge or consent
Agencies should collect and use personal information only as appropriately limited and should obtain it with appropriate knowledge or consent. This action addresses the decision to gather data, not only the security of data already held.
What the report’s numbers show
Federal incidents reported in fiscal year 2022
“Federal agencies reported 30,659 information security incidents to the Department of Homeland Security’s United States Computer Emergency Readiness Team in fiscal year 2022.”
That wording is from GAO-24-107231, published June 13, 2024. The figure is a count of incidents reported to DHS’s United States Computer Emergency Readiness Team for FY 2022; it is not a count of every cyber event affecting the country.
Recommendation status as of May 2024
GAO identified 1,610 recommendations in public reports since 2010 addressing the four challenge areas. Of those, 1,043 were implemented and 567 were unimplemented as of May 2024. This is a dated status snapshot for the recommendations covered by the report, not a present-day total or a measure that every cybersecurity weakness has been eliminated.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →How later GAO information differs
GAO’s current Cybersecurity topic overview, accessed September 27, 2026, provides newer figures on a broader basis. They should not be described as revisions embedded in the 2024 report.
| Measure | GAO-24-107231 | GAO cybersecurity overview |
|---|---|---|
| Federal information-security incidents | 30,659 reported in FY 2022 | 32,211 reported in FY 2023 |
| GAO cybersecurity recommendations since 2010 | 1,610 addressing the four challenge areas; 1,043 implemented and 567 unimplemented as of May 2024 | More than 4,400 overall; more than 730 not fully implemented as of February 2026; 48 identified as priority recommendations |
| Scope and date | Report-specific findings, published June 13, 2024 | Broader, dynamic overview observed September 27, 2026 |
The overview also describes ransomware, viruses and worms, spear-phishing, watering-hole attacks, supply-chain compromise, and remote-login exploits. Those examples and the FY 2023 count belong to the later overview, not to the historical incident figure in GAO-24-107231.
How to use the findings in federal oversight
For an agency, inspector general, congressional office, or program manager, the report is most useful as a cross-government checklist:
Quick Recap
- Assign ownership across all four areas. Identify which officials and organizations own each of the 10 actions, including actions that cross agency or sector boundaries.
- Track implementation, not just policy issuance. Require milestones and evidence that government-wide initiatives and agency security programs are operating as intended.
- Connect enabling capacity to operational risk. Workforce plans, supply-chain controls, and emerging-technology safeguards should be considered alongside system security and incident response.
- Test the national response chain. Incident reporting, coordination, recovery, and lessons learned should work across agencies and, where relevant, critical-infrastructure partners.
- Put privacy at the point of collection. Review whether personal information is necessary, how it will be used, and whether people receive appropriate knowledge or consent before collection.
Important limits on interpreting the report
- The 30,659 figure covers incidents federal agencies reported to DHS’s United States Computer Emergency Readiness Team in FY 2022; it does not represent all cyberattacks or all victims.
- The 1,610-recommendation status was measured in May 2024 and covers the four challenge areas in this report. It should not be compared directly with the overview’s later, broader totals without noting the different scope and dates.
- GAO’s framework does not claim that one agency, technology, or commercial product can resolve national cybersecurity risk.
- The report is aimed at federal management and oversight. Consumer antivirus, computer-repair, or optimization advice does not address its central findings.
Primary documents
- GAO-24-107231 report page, U.S. Government Accountability Office, published June 13, 2024.
- Official GAO-24-107231 PDF.
- GAO Cybersecurity topic overview, accessed September 27, 2026.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
