We recommend the DHS Chief Information Officer enforce requirements for components to obtain authority to operate and resolve critical and high-risk vulnerabilities, implement required configuration settings, and apply sufficient resources to mitigate security weaknesses for both their unclassified systems and national security systems.