FISMA Authorized and Strengthened Information Security Requirements

Enacted into law on December 17, 2002, as Title III of the E- Government Act of 2002, FISMA authorized and strengthened  information security program, evaluation, and reporting  requirements. Specifically, this program is to include:  ●  periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems;  ●  risk-based policies and procedures that cost-effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system;  ●  subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems;  ●  security awareness training for agency personnel, including  contractors and other users of information systems that support the  operations and assets of the agency;  ●  periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of  major information systems;  ●  a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information  security policies, procedures, and practices of the agency;  ●  procedures for detecting, reporting, and responding to security  ●  plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency. DHS uses a variety of major applications and general support  systems in support of operational and administrative requirements. Department of Homeland Security’s FISMA Reports Highlight Increases in Performance Measures, but Challenges Remain

In its FISMA-mandated report for fiscal year 2004, DHS generally  reported increases in compliance with information security  requirements as compared with 2003. However, DHS continues to  face significant challenges. DHS has yet to develop a complete and accurate inventory, or an  effective plan of action and milestones. DHS reported a significant increase for this performance measure in  its fiscal year 2004 report. DHS reported a substantial increase in the percentage of employees  and contractors who received security awareness training in fiscal  year 2004. The Department reported that it had trained 85 percent of  its staff compared to 14 percent in 2003. The total number of agency systems is a key element in OMB’s  performance measures, in that agency progress is indicated by the  percentage of total systems that meet specific information security  requirements. In summary, DHS generally showed increases in the OMB  performance measures for FISMA implementation in fiscal year  2004. However, it still faces challenges in implementing the statutory  requirements.
Why GAO Did This Study

For many years, GAO has reported that poor information security is a widespread problem that has potentially devastating consequences. Accordingly, since 1997, GAO has identified information security as a governmentwide high-risk issue in reports to Congress--most recently in January 2005. Concerned with accounts of attacks on commercial systems via the Internet and reports of significant weaknesses in federal computer systems that made them vulnerable to attack, Congress passed the Federal Information Security Management Act of 2002 (FISMA), which permanently authorized and strengthened the federal information security program, evaluation, and reporting requirements established for federal agencies. FISMA requires that agencies report annually to OMB who issues guidance for that reporting process. The Department of Homeland Security (DHS), the third largest agency in the federal government, uses a variety of major applications and general systems in support of operational and administrative requirements. This testimony discusses DHS's progress and challenges in implementing FISMA as reported by the agency and its Inspector General (IG).

What GAO Found

DHS has made progress in implementing key federal information security requirements, yet it continues to face challenges in fulfilling the requirements mandated by FISMA. In its fiscal year 2004 report on FISMA implementation, DHS highlights increases in the majority of the key performance measures (developed by the Office of Management and Budget (OMB) to track agency performance in implementing information security requirements), such as the percentage of agency systems reviewed and percentage of employee and contractor personnel who received security awareness training. For example, DHS reported a substantial increase in the percentage of personnel that received security awareness training, rising from 14 percent in fiscal year 2003 to 85 percent in fiscal year 2004. However, DHS continues to face significant challenges in meeting most statutory information security requirements. For example, DHS has yet to develop a complete and accurate inventory or an effective remediation process.