An independent cybersecurity review across the largest federal agencies in the United States — cabinet departments and independent agencies serving hundreds of millions of Americans including IRS, SSA, and CMS — reveals a surprisingly wide range of results. These organizations handle sensitive customer and financial data at national scale, yet several show the same email-authentication gaps found at much smaller regional institutions.
Using data from audit.emailmenow.com, we evaluated each agency’s primary domain across email, website, and network security — including SPF, DKIM, DMARC, MTA-STS/TLS, and security headers.
In this national audit, scores ranged from 75% to 44% — 3 of 18 (17%) scored below 60%.
Cybersecurity Scores of Federal Agencies
Overall compliance scores from audit.emailmenow.com. Re-run any domain at the link to verify.
| Rank | Federal Agency | Domain | Overall Score | Website Score | Performance Level |
|---|---|---|---|---|---|
| 1 | FTC | ftc.gov | 75% | 45% | Good |
| 2 | CMS | cms.gov | 73% | 45% | Good |
| 2 | HHS | hhs.gov | 73% | 45% | Good |
| 4 | DHS | dhs.gov | 71% | 45% | Good |
| 4 | USDA | usda.gov | 71% | 45% | Good |
| 4 | SEC | sec.gov | 71% | 45% | Good |
| 4 | CFPB | cfpb.gov | 71% | 45% | Good |
| 4 | Education Dept | ed.gov | 71% | 45% | Good |
| 9 | Social Security Administration | ssa.gov | 69% | 45% | Above Average |
| 9 | SBA | sba.gov | 69% | 45% | Above Average |
| 9 | FDIC | fdic.gov | 69% | 45% | Above Average |
| 12 | IRS | irs.gov | 65% | 45% | Above Average |
| 12 | VA | va.gov | 65% | 45% | Above Average |
| 12 | FBI | fbi.gov | 65% | 45% | Above Average |
| 15 | GSA | gsa.gov | 64% | 45% | Above Average |
| 16 | USA.gov | usa.gov | 58% | 45% | Average |
| 17 | OCC | occ.gov | 45% | 45% | Below Average |
| 18 | Treasury Dept | treasury.gov | 44% | 45% | Below Average |
Website Security Scores
Scores ranged from 45% to 45%; 0 of 18 reached the 100% ideal and 18 scored below 60%.
| Rank | Federal Agency | Domain | Website Score | Rating |
|---|---|---|---|---|
| 1 | FTC | ftc.gov | 45% | Below Average |
| 1 | CMS | cms.gov | 45% | Below Average |
| 1 | HHS | hhs.gov | 45% | Below Average |
| 1 | DHS | dhs.gov | 45% | Below Average |
| 1 | USDA | usda.gov | 45% | Below Average |
| 1 | SEC | sec.gov | 45% | Below Average |
| 1 | CFPB | cfpb.gov | 45% | Below Average |
| 1 | Education Dept | ed.gov | 45% | Below Average |
| 1 | Social Security Administration | ssa.gov | 45% | Below Average |
| 1 | SBA | sba.gov | 45% | Below Average |
| 1 | FDIC | fdic.gov | 45% | Below Average |
| 1 | IRS | irs.gov | 45% | Below Average |
| 1 | VA | va.gov | 45% | Below Average |
| 1 | FBI | fbi.gov | 45% | Below Average |
| 1 | GSA | gsa.gov | 45% | Below Average |
| 1 | USA.gov | usa.gov | 45% | Below Average |
| 1 | OCC | occ.gov | 45% | Below Average |
| 1 | Treasury Dept | treasury.gov | 45% | Below Average |
What the Results Reveal
- Scores range from 75% (FTC) down to 44% (Treasury Dept) — FTC (75%), CMS (73%), and HHS (73%) lead the field.
- Treasury (44%) and OCC (45%) trail most cabinet-level domains — a reminder that .gov status alone does not guarantee strong email hygiene.
- The gap from top to bottom is 31 points across agencies Americans trust for tax, benefits, and financial oversight.
- Without an enforced DMARC policy, criminals can spoof a .gov domain to phish citizens about refunds, benefits, or account verification.
Attack exposure in this audit
Domains scoring near 44% combine weak identity enforcement, missing inbound transport protections, and sub-60% website hardening. Without naming specific organizations, entities in that tier are disproportionately exposed to:
- Public-sector procurement fraud — spoofed
.govmail used to alter vendor payment instructions and grant reimbursement accounts. - Business email compromise (BEC) — spoofed messages appearing to come from executives or accounts payable, used to redirect wires and ACH payments.
- Brand impersonation phishing — fake billing, HR, and vendor notices that pass visual inspection because DMARC and SPF are not fully enforced.
- Credential harvesting — login pages linked from forged
@company.commail aimed at employees, contractors, and customers. - Invoice and procurement fraud — altered payment instructions sent to finance teams and partners who trust the corporate domain.
- Account-recovery abuse — password-reset and MFA prompts triggered from impersonated sender addresses.
- Inbound mail downgrade attacks — absence of enforced MTA-STS allows opportunistic TLS stripping on messages destined for the organization.
- Clickjacking and session risks — missing HSTS, CSP, and frame protections on the public site increase browser-side attack surface for visitors and logged-in users.
- Supply-chain targeting — partners who whitelist the domain for deliverability become secondary victims when spoofed mail originates unchecked.
- Header gaps at scale — 18 of 18 domains scored below 60% on website security in this audit. Clickjacking and session risks are not confined to the bottom tier; many names share a 45% website score — the same floor shared by 17 other domains in this audit.
These are not theoretical edge cases. State breach portals and FBI IC3 reporting consistently tie weak email authentication and header gaps to measurable financial loss at large enterprises.
Real attacks, told as stories
The stories below are made up, but they are based on real crimes that police and cybersecurity teams see every year. No federal agency is named. Each story shows how weak domain settings can hurt real people — customers, partners, and staff who trust federal agencies.
Story 1: Maria and the payment that was not real
Maria works in a grants accountant at a state agency vendor that invoices a federal program.
On a Tuesday morning, she gets an email that looks normal:
From: accounts-payable@bigbrand.com
Subject: New treasury lockbox for grant reimbursements
The logo looks right. The tone sounds like past federal payment notices. A PDF lists a new routing number.
Maria does not know that bigbrand.com has weak email security. A stranger sent the message from their own server and pretended to be the big brand. That is called brand impersonation.
She approves a $284,000 wire. The money goes to the attacker, not the real company.
The next day, the same fake sender emails two more partners Maria knows from procurement meetings. One ignores it. One also changes bank details. That is supply-chain targeting — hurting partners by faking the main organization’s name.
Attack vectors in this story: brand impersonation · invoice and procurement fraud · supply-chain targeting · business email compromise (BEC)
Simple fix: Strict DMARC (p=reject), SPF (-all), and a rule that every bank change needs a phone call to a known contact — not just email.
Story 2: Jordan clicks “reset password”
Jordan is a program analyst at a federal agency. On Wednesday at 2 p.m., his phone buzzes:
From: it-security@bigbrand.com
Subject: Reset your password in 2 hours or lose access
Jordan is busy. The email looks like IT mail he has seen before. He clicks the link.
The page looks like his company login. It is not. It is a copy on a similar-looking website (bigbrand-secure.com). He types his username and password. The attacker saves them.
This is account-recovery abuse and credential harvesting. The criminal used a fake “reset your account” message because people trust mail from @company.com.
That night, the attacker signs into Jordan’s mailbox and reads old threads about an emergency procurement wire. On Thursday, they email the CFO’s assistant:
From: cfo@bigbrand.com
Subject: Urgent — confidential wire for escrow
That is BEC — business email compromise. The assistant almost approves it. A bookkeeper asks, “Did you talk to the CFO on the phone?” The wire stops. Jordan still has to change every password he reused.
Attack vectors in this story: account-recovery abuse · credential harvesting · business email compromise (BEC)
Simple fix: DMARC p=reject, train staff that IT will never rush a reset by email alone, and require a callback before any wire.
Story 3: The contract email no one knew could be copied
Priya is a contracting officer emailing solicitation amendments. She emails a solicitation amendment to an inbox at @bigbrand.com. The send button works. Her screen says Delivered.
What Priya cannot see: on part of the internet path, the mail server connection was downgraded from locked (TLS) to unlocked. Without MTA-STS set to mode=enforce, the recipient’s mail system still accepts the message. An attacker on that path can copy attachment text in plain form.
This is an inbound mail downgrade attack. Most people worry about fake outgoing email. MTA-STS protects incoming mail — mail sent to your organization.
Priya’s CIO shop sees green checkmarks in their dashboard. Nothing looks wrong. Weeks later, a bidder appears to know evaluation criteria early. The leak might have started on the wire, not in someone’s inbox.
Attack vector in this story: inbound mail downgrade (no MTA-STS)
Simple fix: Publish MTA-STS in enforce mode and turn on TLS-RPT reports so IT gets alerted when encryption fails.
Story 4: Alex applies for a job online
Alex is a college senior. He is already logged into his school portal in one browser tab. In another tab, he opens a job post: “Federal careers — verify your USAJOBS profile.”
The site asks him to “confirm your profile” on what looks like the real company careers page. He clicks.
He does not know the page is a trap. The real login screen is hidden inside an invisible frame on a scam site. That trick is called clickjacking. The company’s website scored 45% on security headers — a floor shared by 18 of 18 domains in this audit, missing strong HSTS, CSP, and frame blocking.
Alex thinks he is on the real site. He is really interacting with a layer the attacker controls. If he had been logged into the company’s vendor portal in another tab, the same trick could hijack that session.
No phishing email was needed. The attack lived on the website, not in the inbox.
Attack vectors in this story: clickjacking · session risks (missing HSTS/CSP)
Simple fix: Add HSTS, Content-Security-Policy, and frame-ancestors / X-Frame-Options so login pages cannot be embedded on random sites.
How the stories connect
All four stories can hit one organization with a weak audit score (near 44%):
| Story | Who got hurt | Main gap |
|---|---|---|
| Maria (partner) | Outside partners | Fake mail from your domain |
| Jordan (employee) | Inside staff | Fake password-reset mail |
| Priya (professional) | Confidential data in transit | Incoming mail not forced to stay encrypted |
| Alex (visitor) | Website visitors | Login page can be framed by attackers |
Together, that is not one bug — it is a pattern. Fixing it means better DNS (DMARC, MTA-STS), better website headers, and better office rules (call back before you wire).
Why This Matters for Federal Agencies
Federal agencies are bound by FISMA, CISA binding operational directives, and OMB cybersecurity requirements. Email authentication (SPF, DKIM, and an enforced DMARC policy) is the single highest-impact control against citizen phishing, vendor impersonation, and business email compromise targeting benefits, tax, and benefits programs.
Check any agency’s posture at audit.emailmenow.com/?industry=local-government.
See also — state audits
- Texas School Districts
- California School Districts
- Florida School Districts
- Illinois School Districts
- New York School Districts
- Pennsylvania School Districts
- Ohio School Districts
- Georgia School Districts
- Michigan School Districts
Recommendations
- Enforce DMARC (
p=reject), strict SPF (-all), and DKIM signing. - Add MTA-STS and website security headers.
- Adopt verified call-back procedures for any change to payment or wiring instructions, and train customer-facing staff.
Protect your organization. Run a free Instant Cybersecurity Audit at audit.emailmenow.com/?industry=local-government.
Contact EmailMeNow IT Consulting for help with FISMA-aligned email security hardening.
Source & methodology: Overall compliance scores from the free scan at audit.emailmenow.com — each domain checked for email authentication (SPF, DKIM, DMARC), transport security (MTA-STS/TLS), website security headers, and network security. Re-run any domain at the link to verify.