In order to ensure the implementation of this framework, FISMA assigns  specific responsibilities to (1) OMB, to develop and oversee the  implementation of policies, principles, standards, and guidelines on  information security; to report, at least annually, on agency compliance  with the act; and to approve or disapprove, agency information security  programs; (2) agency heads, to provide information security protections  commensurate with the risk and magnitude of the harm resulting from  unauthorized access, use, disclosure, disruption, modification, or  destruction of information collected or maintained by or on behalf of the  agency; (3) agency heads and chief information officers, to develop,  document, and implement an agencywide information security program,  among others; (4) inspectors general, to conduct annual independent  evaluations of agency efforts to effectively implement information security;  and (5) NIST to provide standards and guidance to agencies on  information security. Accordingly, we and agency  inspectors general have made hundreds of recommendations to agencies  in fiscal years 2010 and 2011 to address these security control  deficiencies. The Number of Incidents Reported by Federal Agencies Continues to Rise

Federal agencies have reported increasing numbers of security incidents  that placed sensitive information at risk. An underlying  reason for these weaknesses was that the Internal Revenue Service  had not yet fully implemented required components of its  comprehensive information security program. We continue to identify information security as a  governmentwide high-risk issue in our biennial reports to Congress, most  recently in February 2011. Actions Under Way, but More Work Necessary for Implementing FISMA Requirements

OMB, executive branch agencies, and NIST have taken actions intended  to improve the implementation of their FISMA-related security  requirements, but much work remains. Beginning in fiscal year 2009,  OMB instituted the use of a new online tool for agencies to report their  information security posture on a recurring basis and, in fiscal year 2010,  provided them with new and revised metrics for reporting such  information. Conclusions

Persistent governmentwide weaknesses in information security controls  threaten the confidentiality, integrity, and availability of the information  and information systems supporting the operations and assets of federal  agencies. Until hundreds of recommendations made by us  and inspectors general are implemented and program weaknesses are  corrected, agencies will continue to face challenges in securing their  information and information systems. In response to  our recommendation, OMB stated that since, unlike in previous years,  OMB and DHS now issue separate memoranda regarding FISMA  reporting guidance, it is more appropriate for the performance targets to  be included in DHS’s memorandum since that is where the metrics are  listed. We agree that including the performance targets in the metrics  issued by DHS would meet the intent of our recommendation. All seven responded that  they did not have any comments. Appendix I: Objectives, Scope, and Methodology

In accordance with the Federal Information Security Management Act of  2002 (FISMA) requirement that the Comptroller General report  periodically to the Congress, our objectives were to evaluate (1) the  adequacy and effectiveness of agencies’ information security policies and  practices and (2) federal agencies’ implementation of FISMA  requirements. In addition, we  reviewed the mandated annual FISMA reports from the Office of  Management and Budget and the National Institute of Standards and  Technology, as well as the Department of Homeland Security’s U.S.  Computer Emergency Readiness Team report of security incidents for  fiscal year 2010. Specifically, FISMA requires information security programs to include,  among other things:    periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems;  risk-based policies and procedures that cost-effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system; subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems, as  appropriate; security awareness training for agency personnel, including  contractors and other users of information systems that support the  operations and assets of the agency;   periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems;   a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in the information  security policies, procedures, and practices of the agency;    procedures for detecting, reporting, and responding to security    plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency.
Why GAO Did This Study

For many years, GAO has reported that weaknesses in information security can lead to serious consequences--such as intrusions by malicious individuals, compromised networks, and the theft of sensitive information including personally identifiable information--and has identified information security as a governmentwide high-risk area. The Federal Information Security Management Act of 2002 (FISMA) established information security program, evaluation, and annual reporting requirements for federal agencies. The act requires the Office of Management and Budget (OMB) to oversee and report to Congress on agency information security policies and practices, including agencies' compliance with FISMA. FISMA also requires that GAO periodically report to Congress on (1) the adequacy and effectiveness of agencies' information security policies and practices and (2) agencies' implementation of FISMA requirements. To do this, GAO analyzed information security-related reports and data from 24 major federal agencies, their inspectors general, OMB, and GAO.

What GAO Found

Weaknesses in information security policies and practices at 24 major federal agencies continue to place the confidentiality, integrity, and availability of sensitive information and information systems at risk. Consistent with this risk, reports of security incidents from federal agencies are on the rise, increasing over 650 percent over the past 5 years. Each of the 24 agencies reviewed had weaknesses in information security controls. An underlying reason for these weaknesses is that agencies have not fully implemented their information security programs. As a result, they have limited assurance that controls are in place and operating as intended to protect their information resources, thereby leaving them vulnerable to attack or compromise. In reports for fiscal years 2010 and 2011, GAO and agency inspectors general have made hundreds of recommendations to agencies for actions necessary to resolve control deficiencies and information security program shortfalls. Agencies generally agreed with most of GAO's recommendations and indicated that they would implement them. OMB, agencies, and the National Institute of Standards and Technology took actions intended to improve the implementation of security requirements, but more work is necessary. Beginning in fiscal year 2009, OMB provided agencies with a new online tool to report their information security postures and, in fiscal year 2010, instituted the use of new and revised metrics. Nevertheless, OMB's guidance for those metrics did not always provide performance targets for measuring improvement. In addition, weaknesses were identified in the processes agencies used to implement requirements. Specifically, agencies did not always ensure (1) personnel with significant responsibilities received training; (2) security controls were monitored continuously; (3) weaknesses were remediated effectively; and (4) incidents were resolved in a timely manner, among other areas. Until hundreds of recommendations are implemented and program weaknesses are corrected, agencies will continue to face challenges in securing their information and information systems.

What GAO Recommends

GAO is recommending that the Director of OMB provide performance targets for metrics included in OMB's annual FISMA reporting instructions to agencies and inspectors general. OMB stated it was more appropriate for those targets to be included in the performance metrics that are now issued separately by the Department of Homeland Security. GAO agrees that this meets the intent of its recommendation.