The GAO calls on the service to adopt six key recommendations to improve the ability of its staff to respond to cyberattacks.

Industry will have until Nov. 14 to comment on the Cyber Incident Reporting for Critical Infrastructure Act of 2022.

"It's a very, very tough situation with cybersecurity hiring. It's extremely difficult getting the right people with the right skills right now."

The agency seeks a vendor to evaluate existing technologies and approaches and select one for a test case.

In fiscal 2021 the agency had to request $600 million in interappropriation transfers to cover its IT spending shortfall.

The oversight body identified failings including the overzealous retention of social security numbers.