The information handled by these  systems includes sensitive or confidential business information on drug  submissions and adverse event reports, among other types of  information. Both  logical and physical access controls are intended to prevent, limit, and  detect unauthorized access to computing resources, programs,  information, and facilities. As shown in table 2, weaknesses existed in each of these areas for the  systems we reviewed. FDA did not always adequately ensure that its network boundaries were  sufficiently segregated. FDA conducted background investigations for the employees and  contractors we reviewed. Media can include magnetic tapes, optical  disks (such as compact disks), and hard drives. Agencies safeguard used  media to ensure that the information they contain is appropriately  controlled or disposed of. FDA Did Not Fully Implement Its Information Security Program, Limiting the Effectiveness of Information Security Controls

A key reason for the weaknesses in controls over FDA’s information and  information systems is that it has not yet fully implemented its agency- wide information security program to ensure that controls are effectively  established and maintained. FISMA requires each agency to develop,  document, and implement an information security program that, among  other things, includes a periodic assessment of risk and magnitude of harm that could result  from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems; policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements;  subordinate plans for providing adequate information security for  networks, facilities, and systems or a group of information systems, as  appropriate;  security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies  and procedures, as well as training personnel with significant security  responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems; a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in information security  policies, procedures, or practices; and procedures for detecting, reporting, and responding to security  incidents. FDA Has Taken Steps to Assess Risks, but Some Practices Have Not Been Fully Implemented. However, the agency did not always ensure that the plans were complete,  or that plans were reviewed. 5. 15. We are also making 166 technical recommendations in a separate report  with limited distribution. In the comments  (reprinted in appendix II), the department stated that FDA concurred with  our recommendations, has begun implementing several of them, and is  actively working to address all the recommendations as quickly and  completely as possible. The department emphasized its commitment to protecting the public  health and proprietary business information at FDA, including by  implementing layered defenses and other compensating controls. As stated in the report, we identified a significant number of  weaknesses in technical controls—including access controls, change  controls, and patch management—that jeopardize the confidentiality,  integrity, and availability of the seven moderate- and high-impact systems  we reviewed. As previously mentioned, these  weaknesses place the seven FDA systems, including those that receive,  process, and maintain sensitive industry and public health data, at  increased and unnecessary risk of unauthorized access, use, or  modification. Appendix I: Objective, Scope, and Methodology

The objective of our review was to evaluate the extent to which the Food  and Drug Administration (FDA) has implemented information security  controls to effectively protect the confidentiality, integrity, and availability  of its information on selected information systems. Using the requirements identified by the Federal Information Security  Modernization Act of 2014 (FISMA), which establishes key elements for  an effective agency-wide information security program, and associated  NIST guidelines, Department of Health and Human Services and Food  and Drug Administration Requirements, we evaluated FDA’s information  security program by  reviewing assessments of risk for six FDA systems to determine  whether threats and vulnerabilities were being identified; analyzing FDA policies, procedures, and practices to determine their  effectiveness in providing guidance to personnel responsible for  securing information and information systems; analyzing security plans for six systems to determine if those plans  had been documented and updated according to federal guidance; examining the security awareness training for employees and  contractors to determine whether they had received training according  to federal requirements; examining training records for personnel who have significant  responsibilities to determine whether they had received training  commensurate with those responsibilities; analyzing FDA’s procedures and results for testing and evaluating  security controls to determine whether management, operational, and  technical controls for seven systems had been sufficiently tested at  least annually and based on risk;  reviewing FDA’s implementation of continuous monitoring practices to  determine whether the agency had developed and implemented an  information system continuous monitoring strategy to manage its IT  assets and monitor the security configurations and vulnerabilities for  those assets; examining FDA’s process to correct weaknesses and to determine  whether remedial action plans complied with federal guidance; and  reviewing FDA’s implementation of incident response practices.
Why GAO Did This Study

FDA has a demanding responsibility of ensuring the safety, effectiveness, and quality of food, drugs, and other consumer products. In carrying out its mission, FDA relies extensively on information technology systems to receive, process, and maintain sensitive industry and public health data, including proprietary business information such as industry drug submissions and reports of adverse reactions. Accordingly, effective information security controls are essential to ensure that the agency's systems and information are adequately protected from inadvertent or deliberate misuse, improper modification, unauthorized disclosure, or destruction.
GAO was asked to examine security controls over key FDA information systems. GAO assessed the extent to which FDA had effectively implemented information security controls to protect the confidentiality, integrity, and availability of its information on seven information systems selected for review. To do this, GAO reviewed security policies, procedures, reports, and other documents; examined the agency's network infrastructure; tested controls for the seven systems; and interviewed FDA personnel.

What GAO Found

Although the Food and Drug Administration (FDA), an agency of the Department of Health and Human Services (HHS), has taken steps to safeguard the seven systems GAO reviewed, a significant number of security control weaknesses jeopardize the confidentiality, integrity, and availability of its information and systems. The agency did not fully or consistently implement access controls, which are intended to prevent, limit, and detect unauthorized access to computing resources. Specifically, FDA did not always (1) adequately protect the boundaries of its network, (2) consistently identify and authenticate system users, (3) limit users' access to only what was required to perform their duties, (4) encrypt sensitive data, (5) consistently audit and monitor system activity, and (6) conduct physical security reviews of its facilities. FDA conducted background investigations for personnel in sensitive positions, but weaknesses existed in other controls, such as those intended to manage the configurations of security features on and control changes to hardware and software; plan for contingencies, including systems disruptions and their recovery; and protect media such as tapes, disks, and hard drives to ensure information on them was “sanitized” and could not be retrieved after they are disposed of. The table below shows the number of GAO-identified weaknesses and associated recommendations, by control area.
These control weaknesses existed, in part, because FDA had not fully implemented an agency-wide information security program, as required under the Federal Information Security Modernization Act of 2014 and the Federal Information Security Management Act of 2002. For example, FDA did not
ensure risk assessments for reviewed systems were comprehensive and addressed system threats,
review or update security policies and procedures in a timely manner,
complete system security plans for all reviewed systems or review them to ensure that the appropriate controls were selected,
ensure that personnel with significant security responsibilities received training or that such training was effectively tracked,
always test security controls effectively and at least annually,
always ensure that identified security weaknesses were addressed in a timely manner, and
fully implement procedures for responding to security incidents.
Until FDA rectifies these weaknesses, the public health and proprietary business information it maintains in these seven systems will remain at an elevated and unnecessary risk of unauthorized access, use, disclosure, alteration, and loss.

What GAO Recommends

GAO is making 15 recommendations to FDA to fully implement its agency-wide information security program. In a separate report with limited distribution, GAO is recommending that FDA take 166 specific actions to resolve weaknesses in information security controls. HHS stated in comments on a draft of this report that FDA concurred with GAO's recommendations and has begun implementing several of them.