Delphi-Prism  produces SEC’s financial statements. Under FISMA, the SEC Chairman has responsibility for, among other  things, (1) providing information security protections commensurate with  the risk and magnitude of harm resulting from unauthorized access, use,  disclosure, disruption, modification, or destruction of the agency’s  information systems and information; (2) ensuring that senior agency  officials provide information security for the information and information  systems that support the operations and assets under their control; and  (3) delegating to the agency chief information officer (CIO) the authority to  ensure compliance with the requirements imposed on the agency. However,  weaknesses limited the effectiveness of other controls in protecting the  confidentiality, integrity, and availability of SEC’s information systems. Although SEC had issued policies and implemented controls based on  those policies, it did not consistently protect its network from possible  intrusions, identify and authenticate users, authorize access to resources,  audit and monitor actions taken on its systems and network, and restrict  physical access to sensitive assets. As a result, SEC is at  an increased risk that accounts could be compromised and used by  unauthorized individuals to access sensitive financial data. However, SEC did not always ensure that only authorized individuals  were granted access to its systems. SEC did not maintain and monitor official configuration baselines for  some of the platforms used to host financially significant systems and  general support system that we reviewed. However, SEC did not appropriately separate incompatible access to  three computing environments for 20 individuals. Although SEC had developed contingency and disaster recovery plans  and implemented controls for this planning, its plans were not complete or  up to date. SEC Did Not Fully Implement Its Information Security Program

The information security weaknesses existed in the SEC computing  environment, in part, because SEC had not fully implemented key  elements of its agency-wide information security program. Specifically, it  did not always (1) review and update its policies in a timely manner, (2)  completely document plans of actions and milestones items, (3)  document its physical inventory, and (4) fully implement and effectively  manage its continuous monitoring program. SEC Made Limited Progress Remediating Previously Reported Information Security Control Weaknesses

SEC resolved 5 of the 20 previously reported information security control  deficiencies in the areas of access controls, audit and monitoring, and  separation of duties that remained unresolved as of September 30, 2014. In particular, SEC resolved 2 weaknesses important to improving its  information security by separating the user production network from the  internal management network and storing all critical system logs in a  centralized location for a key financial system. While SEC had made progress in addressing the remaining 15 of 20  previously reported weaknesses, these weaknesses still existed as of  September 30, 2015. Conclusions

While SEC had improved its information security by addressing previously  identified weaknesses, the information security control weaknesses that  continued to exist in its computing environment may jeopardize the  confidentiality, integrity, and availability of information residing in and  processed by the system. In a separate report with limited distribution, we are also making 30  recommendations to address newly identified control weaknesses related  to access controls, configuration management, segregation of duties,  physical security, and contingency and disaster recovery plans. II), SEC concurred with the six recommendations addressing its  information security program. SEC also stated that the commission had  taken action to address one recommendation and described actions to  address the other five. This report contains recommendations to you. Appendix I: Objective, Scope, and Methodology

Our objective was to determine the effectiveness of the Securities and  Exchange Commission’s (SEC) information security controls for ensuring  the confidentiality, integrity, and availability of its key financial systems  and information.
Why GAO Did This Study

The SEC is responsible for enforcing securities laws, issuing rules and regulations that provide protection for investors, and helping to ensure that the securities markets are fair and honest. In carrying out its mission, the SEC relies on computerized information systems to collect, process, and store sensitive information, including financial data. Having effective information security controls in place is essential to protecting these systems and the information they contain.
This report details weaknesses GAO identified in the information security program at SEC during its audit of the commission's fiscal years 2015 and 2014 financial statements. GAO's objective was to determine the effectiveness of information security controls for protecting the confidentiality, integrity, and availability of SEC's key financial systems and information. To do this, GAO examined information security policies, plans, and procedures; tested controls over key financial applications; interviewed agency officials; and assessed corrective actions taken to address previously reported weaknesses.

What GAO Found

The Securities and Exchange Commission (SEC) improved its information security by addressing weaknesses previously identified by GAO, including separating the user production network from the internal management network. However, weaknesses continue to limit the effectiveness of other security controls. In particular:
While SEC had issued policies and implemented controls based on those policies, it did not consistently protect access to its systems. Organizations should design and implement controls to prevent, limit, and detect unauthorized access to computer resources. The commission did not consistently protect its network from possible intrusions, identify and authenticate users, authorize access to resources, audit and monitor actions taken on its systems and network, and restrict physical access to sensitive assets.
The commission did not consistently manage the configuration of its systems. Configuration management includes ensuring that hardware and software are configured with appropriate security features and that changes are systematically controlled. However, SEC did not maintain and monitor official configuration baselines for its financial systems and general support system.
The commission did not always appropriately separate incompatible duties. Separation of duties involves dividing responsibilities so that a single individual does not control all critical stages of a process. However, SEC did not adequately separate duties among its three computing environments.
While SEC had developed contingency and disaster recovery plans for its information systems, those plans were not fully reviewed, completed, or up-to-date. Contingency and disaster recovery planning are essential to resuming operations in the event of a disruption or disaster.
These weaknesses existed in part because SEC had not fully implemented an organization-wide information security program, as called for by federal law and guidance. In particular, the commission had not (1) consistently reviewed and updated its information security policies in a timely manner, (2) completely documented plans of action to address weaknesses, (3) documented a physical inventory of its systems and applications, and (4) fully implemented a program to continuously monitor the security of its systems and networks.
Finally, of 20 weaknesses previously identified by GAO that remained unresolved as of September 30, 2014, SEC had resolved 5 and made progress in addressing the other 15 as of September 30, 2015. Two resolved weaknesses were important to improving SEC security.
Collectively, these weaknesses increase the risk that SEC's systems could be compromised, jeopardizing the confidentiality, integrity, and availability of sensitive financial information. While not constituting material weaknesses or significant deficiencies, they warrant SEC management's attention.

What GAO Recommends

In addition to the 15 prior recommendations that have not been fully implemented, GAO is recommending that SEC take 6 additional actions to more fully implement its information security program. In a separate report with limited distribution, GAO recommended SEC take 30 actions to address newly identified control weaknesses. SEC concurred with GAO's recommendations.