Reviewing agency information security programs, at least annually. Agencies’ Policies Do Not Fully Address Elements Important for Effective Testing and Evaluation

Agencies’ policies for periodically testing and evaluating security controls  have not been adequately designed and effectively implemented. Specifically, none of the federal agencies’ policies fully addressed six  important elements included in OMB and NIST guidelines and standards  for performing effective security testing and evaluations. As a result, agencies have limited  assurance that controls are implemented correctly, operating as intended,  and producing the desired outcome. In addition, agencies may not be fully  aware of security control weaknesses in their systems, thereby leaving the  agencies’ operations and systems at risk. Specifically, the (1) frequency  of periodic testing was not always identified, (2) roles and responsibilities  of personnel performing tests often were not clearly defined, (3) selection  of a minimum set of security controls evaluated during periodic tests was  not always fully addressed, (4) instructions on identification and testing of  common security controls were not addressed, (5) instructions on  determining the depth and breadth of testing were not included, and (6)  descriptions of a process for documenting remedial actions to address  deficiencies were not always addressed. Six Case Study Agencies Did Not Effectively Implement Policies

None of the six case study agencies fully implemented their policies for  periodic information security testing. Agencies did not fully define the assessment methods used to evaluate  their system controls for 7 of the 30 systems reviewed. Agencies Did Not Always Adequately Test Security Controls

Once employed within an information system, security controls should be  tested to determine the extent to which the controls are correctly  implemented, operating as intended, and producing the desired outcome  with respect to meeting the security requirements for the system. For example, testing documentation for  some systems did not address the remedial actions that agencies had  identified from prior assessments in their test plans. Conclusions

Agencies have not adequately designed and effectively implemented  policies for periodically testing information security controls. Also, agency officials reported  that they did not understand this method. To determine the adequacy and effectiveness of federal agencies’ policies  and procedures for testing and evaluating security controls for their  information systems, we conducted a survey of the 24 major agencies,  which included 21 questions for the agencies and 4 questions for the  agencies’ Inspectors General. To assess the implementation of Federal Information Security  Management Act of 2002 (FISMA) requirements, we reviewed 30 systems  at the six case study agencies to determine whether policies for testing  and evaluating security controls were effectively implemented.
Why GAO Did This Study

Agencies rely extensively on computerized information systems and electronic data to carry out their missions. To ensure the security of the information and information systems that support critical operations and infrastructure, federal law and policy require agencies to periodically test and evaluate the effectiveness of their information security controls at least annually. GAO was asked to evaluate the extent to which agencies have adequately designed and effectively implemented policies for testing and evaluating their information security controls. GAO surveyed 24 major federal agencies and analyzed their policies to determine whether the policies address important elements for periodic testing. GAO also examined testing documentation at 6 agencies to assess the quality and effectiveness of testing on 30 systems.

What GAO Found

Federal agencies have not adequately designed and effectively implemented policies for periodically testing and evaluating information security controls. Agencies' policies often did not include important elements for performing effective testing. For example, none of the agencies' policies addressed how to determine the depth and breadth of testing according to risk. Also, agencies did not always address other important elements, including the identification and testing of security controls common to multiple systems, the definition of roles and responsibilities of personnel performing tests, and the frequency of periodic testing. The six case study agencies did not effectively implement policies for periodically testing and evaluating information security controls for the 30 systems reviewed. The methods and practices for testing and evaluating controls at the six agencies were not adequate to ensure that assessments were consistent, of similar quality, and repeatable. For example, these agencies did not always sufficiently document their test methods and results, did not define the assessment methods to be used when evaluating security controls, did not test security controls as prescribed, and did not include previously reported remedial actions or weaknesses in their test plans to ensure they had been addressed. As a result, agencies may not have reasonable assurance that controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements of the agency. In addition, agencies may not be fully aware of the security control weaknesses in their systems, thereby leaving the agencies' information and systems vulnerable to attack or compromise.