OMB previously reported six common security weaknesses for the federal  government. Actions and progress for these weaknesses reported by OMB  in its fiscal year 2002 report were as follows:  Lack of senior management attention to information security. Agencies Show Limited Progress in Implementing Security Requirements

Our analyses of agency performance measure data and individual  agencies’ efforts to implement information security requirements showed  limited progress in many cases. This limited progress is indicated despite  other benefits that that have resulted from GISRA implementation, such as  increased management attention to and accountability for information  security; important actions by the administration, such as integrating  information security into the President’s Management Agenda Scorecard;  an increase in the types of information being reported and made available  for oversight: and the establishment of a baseline for measuring agencies’  performance. Specifically, excluding  data for the National Aeronautics and Space Administration (NASA), our  analysis showed that increases for these same measures only ranged from  3 to 10 percent. As a performance measure for this requirement, OMB required agencies to  report the number and percentage of systems for which security controls  have been tested and evaluated during fiscal years 2001 and 2002. Our analyses of agencies’ fiscal year 2002 corrective action plans, IGs’  evaluations of these plans, and available quarterly updates showed that the  usefulness of these plans as part of agency management’s overall process  to identify and correct their information security weaknesses could be  limited when they do not identify all weaknesses or provide realistic  completion estimates. Agencies Face Continuing Challenges to Implement Effective Information Security Management Programs

The governmentwide weaknesses identified by OMB in its reports to the  Congress, as well as the limited progress in implementing key information  security requirements, continue to emphasize that agencies have not  effectively implemented programs for managing information security. In particular, FISMA provisions established  additional requirements that can assist the agencies in implementing  effective information security programs, help ensure that agency systems  incorporate appropriate controls, and provide information for  administration and congressional oversight. However, in addition to these steps, achieving significant and sustainable  results will likely require agencies to integrate such techniques into overall  security management programs and processes that prioritize and routinely  monitor and manage their information security efforts.
Why GAO Did This Study

Since 1996, GAO has reported that poor information security in the federal government is a widespread problem with potentially devastating consequences. Further, GAO has identified information security as a governmentwide high-risk issue in reports to the Congress since 1997--most recently in January 2003. To strengthen information security practices throughout the federal government, information security legislation has been enacted. This testimony discusses efforts by federal departments and the administration to implement information security requirements mandated by law. In so doing, it examines overall information security weaknesses and challenges that the government faces, and the status of actions to address them, as reported by the Office of Management and Budget (OMB). GAO's evaluation of agency efforts to implement federal information security requirements and correct identified weaknesses. New requirements mandated by the Federal Information Security Management Act of 2002 (FISMA).

What GAO Found

Based on the fiscal year 2002 reports submitted to OMB, the federal government has made limited overall progress in implementing statutory information security requirements, although a number of benefits have resulted. Among these benefits are several actions taken and planned to address governmentwide information security weaknesses and challenges, such as lack of senior management attention. Nevertheless, as indicated by selected quantitative performance measures for the largest federal agencies, progress has been limited. Specifically, excluding data for one agency that were not comparable for fiscal years 2001 and 2002, improvements for 23 agencies ranged from 3 to 10 percentage points for the selected measures. GAO's analyses of agencies' reports and evaluations confirmed that many agencies have not implemented security requirements for most of their systems, such as performing risk assessments and testing controls. Further, the usefulness of agency corrective action plans may be limited when they do not identify all weaknesses or contain realistic completion dates. Agencies also continue to face challenges in effectively implementing and managing their overall information security programs. FISMA provisions establish additional requirements that, among other things, can assist agencies in implementing effective information security programs. However, attaining significant and sustainable results in implementing such requirements will also likely require processes that prioritize and routinely monitor and manage agency efforts, as well as continued congressional and administration oversight.