Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Federal agencies do not yet have a complete picture of how widely critical-infrastructure organizations use leading ransomware protections—or whether federal assistance is reducing their risk. That is the oversight gap identified by the U.S. Government Accountability Office (GAO) in its 2024 review of four selected sectors. It is not evidence that every organization is unprotected.
What GAO found
GAO found that agencies responsible for the selected sectors had assessed or planned to assess sector risks, but had not fully measured adoption of leading ransomware practices or the effectiveness of their own support. As GAO put it, “However, none have fully assessed the effectiveness of their support to sectors, as recommended by the National Infrastructure Protection Plan.”
The distinction matters: a risk assessment identifies or characterizes threats and vulnerabilities; measuring adoption asks whether organizations are using recommended practices; evaluating federal support asks whether assistance is helping reduce risk. Progress on one does not establish progress on the others.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →GAO’s 2024 report covered critical manufacturing, energy, healthcare and public health, and transportation systems. It did not provide a complete assessment of all 16 U.S. critical-infrastructure sectors or every owner and operator. GAO selected the four using factors including lifeline designation, available incident counts, and reported cost impacts. Its work included reviewing incident reporting and risk-analysis documents, comparing agency efforts with cybersecurity guidance, and interviewing sector and federal officials. GAO report and findings
#1 Best Overall
Why the visibility gap matters
GAO reported that ransomware incidents in 2022 affected 14 of the 16 critical-infrastructure sectors. The report also cautioned that the full impact was likely unknown because incident reporting was generally voluntary. The figure describes reported incidents, not a complete census of attacks or a measure of how many organizations had effective safeguards. GAO report and findings
Without reliable information about which practices organizations have adopted, agencies have less basis for identifying where assistance is needed. Without routine evaluation, they also cannot demonstrate whether that assistance—such as warnings, assessments, or other services—is having the intended effect. The finding concerns federal oversight and measurement; it does not show that federal support has no value.
What GAO recommended
GAO issued 11 recommendations to the Departments of Energy (DOE), Health and Human Services (HHS), Homeland Security (DHS), and Transportation (DOT). The recommendations address three distinct tasks: determine whether sectors are adopting leading practices, assess sector ransomware risks where needed, and routinely evaluate the effectiveness of federal support.
| Department or responsibility | GAO’s focus | Status reported by GAO |
|---|---|---|
| DOE — energy | Measure adoption of leading practices and establish routine evaluation of federal support. | As of June 2026, GAO’s tracker said DOE had not demonstrated a determination of practice adoption or routine evaluation procedures. DOE described ongoing collaboration and work on feasible assessment approaches, but had not completed a standalone study. GAO recommendation tracker |
| HHS — healthcare and public health | Assess practice adoption and evaluate federal support. | GAO marked the practice-adoption action implemented. HHS demonstrated analysis of healthcare entities’ use of its Risk Identification and Site Criticality (RISC) Toolkit version 2.0, which asks about training, access privileges, monitoring and detection, and backup-data protection. The support-evaluation recommendation remained partially addressed; GAO said HHS still needed to demonstrate evaluation of feedback and routine collection. GAO recommendation tracker |
| DHS — critical manufacturing and transportation responsibilities | Measure adoption of leading practices and evaluate the effectiveness of federal support. | GAO said DHS had not yet demonstrated assessment of adoption of goals associated with additional ransomware practices. Related support-evaluation recommendations remained partially addressed. GAO called for evaluating other support, including vulnerability warnings, early-stage activity notifications, and remote penetration tests. GAO recommendation tracker |
| DOT — transportation | Assess transportation ransomware risk, measure adoption of practices, and evaluate federal support. | GAO marked the risk-assessment recommendation implemented based on an October 2024 joint assessment with DHS. The practice-adoption and support-evaluation recommendations remained uncompleted in the tracker, with January 2026 identified as the relevant update point. GAO recommendation tracker |
Statuses above reflect the update points described by GAO’s tracker, not a claim that every recommendation has the same status date. Because recommendations can change status, consult the recommendation-specific entries on GAO’s official report page for the latest update.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to interpret the implementation record
Compare follow-through on two axes: what the recommendation asks an agency to do, and the status GAO assigns to that particular recommendation. An implemented transportation risk assessment, for example, is not proof that DOT measured whether organizations adopted recommended practices or demonstrated that federal assistance was effective. Likewise, an agency’s description of ongoing work is not the same as GAO marking a recommendation implemented.
The report’s central point is therefore narrower—and more useful—than a blanket claim that critical infrastructure is unprotected: federal agencies need better evidence about adoption of ransomware protections and a routine way to judge whether their assistance is working.
Quick Recap
Best Value
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
