Objectives, Scope, and Methodology

Our objectives were to (1) determine whether Treasury and its key  bureaus have effectively implemented information security controls to  protect the confidentiality, integrity, and availability of their systems and  data and (2) determine whether Treasury has effectively implemented its  departmentwide information security program. To assess Treasury’s departmentwide information security program, we  reviewed and evaluated the department’s information security policies in  effect at the time of our review;   analyzed data presented in Treasury’s GISRA report for fiscal year 2002  and FISMA report for fiscal year 2003;   examined and assessed reports and other documents related to the  department’s information security program, and interviewed Treasury officials regarding their processes and procedures  for overseeing, monitoring, evaluating, and reporting on the  implementation of information security across the department. Weak security  controls can expose information systems and information to an increased  risk of unauthorized access, use, disclosure, disruption, modification, and  destruction. Some bureaus have consistently reported  implementing effective controls over their information systems and/or  limiting the negative effect control weaknesses could have on the  preparation of financial statements and internal controls. Key Bureaus Have Ineffective Security Controls

Strengthening information systems controls at other bureaus is one of the  management challenges currently facing the Department of the Treasury. Service continuity. Treasury bureaus have not consistently assessed their systems for risk. Most Treasury bureaus did not test the security controls on each of their  inventoried systems during fiscal year 2003. Treasury Has Begun to Implement Key Elements of a Departmentwide Information Security Program, but Challenges Remain

The information security weaknesses and inconsistent security practices  identified at the bureaus exist, in part, because Treasury’s departmentwide  security program, while evolving, is not yet fully institutionalized across  the entire department. As illustrated in figure 6, an analysis of security metric data in  Treasury’s fiscal year 2002 GISRA report and its fiscal year 2003 FISMA  report shows that  the majority of Treasury systems do not meet key information security  requirements, and   Treasury’s reported performance in meeting certain of these requirements  has decreased. In addition, implementation of certain information security requirements  has decreased from fiscal year 2002. For the 11 bureaus that reported  performance measures for both years, the percentage of Treasury systems  implementing five of the six requirements decreased in fiscal year 2003,  while it increased for one. Financial Management Service: Significant Weaknesses in Computer  Controls Continue. Information Security: Software Change Controls at the Department of  Treasury.
Why GAO Did This Study

The Department of the Treasury relies heavily on information systems--and on the public's trust in its work. Information security is therefore critical to Treasury operations. In support of its annual audit of the government's financial statements, GAO assessed the effectiveness of (1) Treasury's information security controls in protecting the confidentiality, integrity, and availability of the department's systems and data and (2) Treasury's implementation of its departmentwide information security program. In assessing the adequacy of Treasury's information security program, GAO focused on the effectiveness of its departmentwide policies and processes, rather than on bureau-specific directives and guidance.

What GAO Found

The Department of the Treasury and its key bureaus have not consistently implemented information security controls to protect the confidentiality, integrity, and availability of their information systems and data. Several bureaus have reported effective controls over their systems. However, longstanding information security weaknesses in access and software change controls, segregation of duties, and service continuity have been consistently identified at certain key Treasury bureaus, such as IRS and the Financial Management Service. Weaknesses at these bureaus place the sensitive information managed by the bureaus at increased risk of unauthorized access, use, disclosure, disruption, modification, or destruction. Moreover, bureaus have not consistently implemented key information security requirements. An analysis of performance data for the 11 Treasury bureaus that reported on these requirements for fiscal years 2002 and 2003 reveals that most Treasury systems did not meet certain key information security requirements in fiscal year 2003 and that the percentage of systems that meet certain requirements has decreased from fiscal year 2002. The information security weaknesses and inconsistent implementation of security controls at Treasury bureaus exist, in part, because Treasury's departmentwide security program, while evolving, has not yet been fully institutionalized across the entire department. During fiscal year 2003, Treasury launched or expanded several initiatives to implement key elements of its program. However, additional actions are needed to effectively and consistently implement information security controls throughout the department.