FDIC relies extensively on computerized systems to support its financial  operations and store the sensitive information it collects. Objectives, Scope, and Methodology

The objectives of our review were to assess (1) the progress FDIC had  made in correcting or mitigating weaknesses reported in connection with  our financial statement audits for calendar years 2002 and 2003 and (2)  the effectiveness of the corporation’s information system controls. Of the 22 weaknesses reported in  our 2003 audit, FDIC corrected 19 and is taking action to resolve the 3 that  remain. In addition, the corporation corrected the one weakness still open  from our 2002 audit. Weaknesses in Information System Controls

Although FDIC made substantial improvements in its information system  controls, we identified 20 additional weaknesses that diminish its ability to  effectively protect the integrity, confidentiality, and availability of its  financial and sensitive information and information systems. Specifically,  we identified weaknesses in electronic access controls, network security,  physical security, segregation of computer functions, and application  change controls. Although these information system control weaknesses  do not pose significant risks to FDIC’s financial and sensitive systems, they  warrant management’s action to decrease the risk of unauthorized  modification of data and programs, inappropriate disclosure of sensitive  information, or disruption of critical operations. FDIC Has Made Substantial Progress Implementing Information Security Program but Has Not Completed Key Element

A key reason for FDIC’s weaknesses in information system controls is that  it had not fully implemented a complete test and evaluation process, which  is a key element of a comprehensive agency information security program. These elements include  a central information security management structure to provide overall  security policy and guidance along with oversight to ensure compliance  with established policies and reviews of the effectiveness of the  information security environment;  periodic assessments of the risk and magnitude of the harm that could  result from unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;  policies and procedures that (1) are based on risk assessments, (2) cost  effectively reduce risks, (3) ensure that information security is  addressed throughout the life cycle of each system, and (4) ensure  compliance with applicable requirements;  security awareness training to inform personnel, including contractors  and other users of information systems, of information security risks  and their responsibilities in complying with agency policies and  procedures; and  a process of tests and evaluations of the effectiveness of information  security policies, procedures, and practices relating to management,  operational, and technical controls of every major information system  identified in the agency’s inventories. These areas included electronic access controls, network security, and  audit logging. Conclusions

FDIC has made significant progress in correcting the information system  control weaknesses we previously identified and has taken other steps to  improve information security. Although the corporation has made substantial progress in implementing  its information security program and enhanced its process to test and  evaluate its information system controls, it did not ensure that all key  control areas supporting its financial environment were routinely reviewed  and tested.
Why GAO Did This Study

The Federal Deposit Insurance Corporation (FDIC) relies extensively on computerized systems to support its financial and mission-related operations. As part of GAO's audit of the calendar year 2004 financial statements for the three funds administered by FDIC, GAO assessed (1) the progress FDIC has made in correcting or mitigating information system control weaknesses identified in our audits for calendar years 2002 and 2003 and (2) the effectiveness of the corporation's information system general controls.

What GAO Found

FDIC has made significant progress in correcting previously reported information system control weaknesses and has taken other steps to improve information security. Of the 22 weaknesses reported in GAO's 2003 audit, FDIC corrected 19 and is taking action to resolve the 3 that remain. In addition, it corrected the one weakness still open from GAO's 2002 audits. Although FDIC has made substantial improvements in its information system controls, GAO identified additional weaknesses that diminish FDIC's ability to effectively protect the integrity, confidentiality, and availability of its financial and sensitive information systems. These included weaknesses in electronic access controls, network security, segregation of computer functions, physical security, and application change control. Although these do not pose significant risks to FDIC's financial and sensitive systems, they warrant management's action to decrease the risk of unauthorized modification of data and programs, inappropriate disclosure of sensitive information, or disruption of critical operations. A key reason for FDIC's weaknesses in information system controls is that it had not fully implemented a complete test and evaluation process, which is a key element of a comprehensive agency information security program with effective controls. Although FDIC has made substantial progress in implementing its information security program and has enhanced its process to test and evaluate its information system controls, it did not ensure that all key control areas supporting FDIC's financial environment are routinely reviewed and tested. These control areas included electronic access, network security, and audit logging.