Summary

  • HHS named ten cybersecurity control areas for the 988 Lifeline, but GAO found only three in its fiscal 2026 agreement with the network administrator and seven in the administrator’s agreement with local centers.
  • None of 12 sampled center checklists delivered all three required security documents by the deadline; five remained incomplete as of March 2026. Officials said their principal sanction is removing a center from the network.

A three-digit number is a promise made by many organizations at once. The caller sees 988. Behind it sit a federal agency, a network administrator, telecommunications providers and roughly 218 independent crisis contact centers. A September report by the U.S. Government Accountability Office found that their cybersecurity obligations do not travel cleanly down this chain. The seam is especially awkward because the harshest available enforcement action can also remove a place that answers the call.

The federal government has seen what an outage costs. A December 2022 ransomware attack on critical 988 infrastructure caused a nationwide disruption lasting several hours. By January 2026, the network was handling 428,000 calls in a single month. Its services span voice, text and chat, with contacts routed to local centers or backup capacity. This is public infrastructure whose critical action is a human conversation, carried by systems that can fail before a counselor ever speaks.

GAO examined a specific governance mechanism: what HHS required in its cooperative agreement with the network administrator, what that administrator required in agreements with centers, and whether monitoring records showed the rules being followed. HHS had defined ten cybersecurity performance-goal control areas. The fiscal 2026 cooperative agreement included three. The administrator’s network agreement included seven. Those numbers describe contract coverage, not the percentage of centers secured or a verdict that every omitted control was absent in practice. They show where a federal requirement lost its binding form.

HHS officials told GAO they lacked authority to impose all of these requirements directly on nonfederal systems, while the administrator could put them into the center participation agreement. That is the power map in one sentence. Washington can name the standard; a separate organization holds the admission contract; independent centers do the work. If the middle agreement drops a control, the federal standard becomes a wish with a filing number.

Even the documents already required were late or missing. GAO reviewed 12 center compliance checklists. None of the 12 included all three security documents before the deadline. Seven delivered them late. Five still had not supplied every document by March 2026. This is a checklist sample, not a census of 218 centers. It nevertheless tests a process that the administrator was meant to operate: a requirement cannot be monitored when the basic evidence arrives after the check, or never arrives at all.

The audit also tested selected technical and organizational controls at the administrator and ten centers. It found the administrator had fully implemented selected continuous-monitoring and incident-response controls, but had not implemented updated password guidance and had only partly implemented selected contingency-planning controls. The sampled centers fully implemented the selected continuous-monitoring control and partly implemented selected incident-response and contingency controls. These findings are narrower than a systemwide security grade.

Their value is diagnostic: detection, response and recovery are different jobs, and an alert is a poor substitute for a rehearsed return to service.

The 988 network is not a single federal data center. Some centers use the administrator’s Unified Platform; others use their own systems. GAO reported 104 centers using that platform as of March 2026. All centers use an exchange portal for network documentation. Center size and technical capacity vary sharply. A uniform rule therefore lands on organizations with different staffing, tools and budgets. Treating an attestation as equivalent to a working recovery plan saves oversight effort precisely where the local ability to prove readiness may be weakest.

Here the enforcement problem turns the usual regulator’s swagger into a practical dilemma. SAMHSA officials said center participation is voluntary and the main recourse for noncompliance is removal from the network. They also told GAO that removing centers could weaken the Lifeline and state crisis services. A sanction that protects the rule on paper may shrink the answer capacity the rule exists to protect. The audit does not supply a published alternative ladder of support, deadlines, verification and proportionate consequences. That missing operational path is the story.

GAO made ten recommendations. Among them: put seven omitted control areas into the federal agreement, put three omitted areas into the network agreement, complete the checklist process, update password guidance and require and monitor incident-response policies, plans and testing at centers. HHS concurred. Concurrence starts an obligation to act; the next evidence is revised agreement language, dated center submissions, tested plans and closure records.

The public record cannot show how many centers could withstand a new attack tomorrow. GAO chose ten centers for a nongeneralizable review and 12 checklists for the documentation test. What would change the judgment is a complete, current control-to-contract map and center-level evidence of timely submissions, exercised response plans and recovery tests. Until those records exist, 988’s single entrance conceals a chain of separately owned doors.

Sources