General computer controls, however, also affect the security and reliability of financial and nonfinancial operations processed by SCC for other Senate offices. Specifically, we evaluated controls intended to protect data, files, and programs from unauthorized access; prevent unauthorized changes to systems and applications software; provide segregation of duties among applications and systems programmers, computer operators, security administrators, and other data center personnel; ensure recovery of computer processing operations in case of a disaster or other unexpected interruption; and ensure adequate computer security administration. SCC officials advised us that they did not plan to implement ACF2 over other mainframe applications due to (1) indications that, for some programs, less rigorous security measures are preferred by user management to provide easier accessibility, (2) resource constraints, and (3) intentions to transition from the mainframe to a decentralized network environment. The technical options that SCC has implemented to control access to the information on its mainframe negate many of the control benefits that the software offers. We identified another area in which SCC could improve its access monitoring controls. SCC did not have a formal change control process to document management’s authorization and approval of routine and emergency changes to systems software. At SCC, we found inadequate segregation of duties, particularly in the granting of powerful security privileges. A comprehensive strategic plan that integrates and controls access and processing for all Senate files, programs, and data is crucial to ensuring that Senate computer resources are adequately safeguarded. Develop, implement, and test a disaster recovery plan for all critical SCC operations.
Why GAO Did This Study

Pursuant to a congressional request, GAO evaluated and tested the general computer controls that affect the overall security and effectiveness of the Senate Computer Center's (SCC) financial systems, focusing on whether those controls: (1) protect data, files, and programs from unauthorized access; (2) prevent unauthorized changes to systems and applications software; (3) provide segregation of duties among computer, security, and other SCC personnel; (4) ensure recovery of computer processing operations in case of unexpected interruption; and (5) ensure adequate computer security administration.

What GAO Found

GAO found that: (1) SCC general computer controls do not adequately protect sensitive data files and computer programs from unauthorized disclosure and modification; (2) SCC has not fully implemented its access control software to control access to other mainframe programs due to a preference for easier access, resource constraints, the planned transition to decentralized networks, conflicting technical options, and poor access monitoring capabilities; (3) SCC lacks formal software change control and documentation procedures; (4) SCC has not adequately segregated computer duties, particularly regarding security privileges; (5) although SCC is developing off-site disaster recovery and contingency capabilities, the Senate could be exposed to significant security risk as it moves toward a decentralized network environment because it does not have a comprehensive strategic plan for its computer resources; and (6) the two Senate offices responsible for Senate receipts and disbursements supplement SCC general computer management controls to ensure data integrity and authorization when reconciling disbursement information with independent records.