In its fiscal year 2001 report to Congress on federal government  information security reform, OMB identified poor security oversight of  contractor-provided IT systems and services as a common governmentwide  challenge. Specifically, this information security program is to include  the following  periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems;  risk-based policies and procedures that cost-effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system;  subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems;  security awareness training for agency personnel, including contractors  and other users of information systems that support the operations and  assets of the agency;  periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, performed with a frequency  depending on risk, but no less than annually, and that includes testing of  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information  systems;  a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency;  procedures for detecting, reporting, and responding to security   plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. In addition,  as part of its statutory responsibilities under FISMA, NIST has issued  standards and guidance that include consideration of security oversight of  contractor-provided IT systems and services and other users with  privileged access to federal data and systems. Contractors that  provide systems and services or other users with privileged access to  federal data and systems can introduce risks to agency information and  systems. Strategic. Of the remaining 7 agencies, 5 indicated that other users do not possess or  use their data and systems; 1 indicated that it had not assessed risks of  other users with privileged access; and the other agency did not respond  regarding whether they had assessed risks of other users with privileged  access to federal data and systems. Agencies Use Various Methods for Overseeing Contractor Security

Federal agencies report using three primary methods for overseeing the  information security of contractors  using contract language to establish information security requirements   having information security policies for contractors and other users  with privileged access to federal data; and   using NIST self-assessment tools to assess contractor security  capabilities and assess the security implemented by other users with  privileged access to federal data. However  when not properly implemented, each of these methods has limitations. Most Agencies Have Information Security Policies for Contractors, but Few Policies Provide for Oversight Capabilities

Although most agencies reported having written policies that addressed  information security for contractor-provided IT services and systems and  for other users with privileged access to federal data and systems, few  established specific policies for overseeing the information security  practices of contractors to ensure compliance with contract requirements  and agency information security policies. However, without such  policies, oversight efforts can be impeded. For example, the information security  requirements in FAR are being revised and OMB continues to gather data  from the agencies about the number of contractor facilities reviewed by  agencies. FISMA requirements  apply to all federal contractors and organizations or sources that possess  or use federal information or that operate, use, or have access to federal  information systems on behalf of an agency. Conclusions

Contractors provide valuable services that contribute to the efficient  functioning of the government, but a range of risks from contractors and  other users with privileged access to federal data and systems must be  managed effectively. To address these complex challenges, a variety of administration efforts  have been started to further enhance federal agencies’ efforts to improve  information security oversight of contractors, but challenges remain. For  example, the effort to update FAR guidance has not been completed. OMB General Counsel  provided oral comments on the report, which have been incorporated as  appropriate. OMB did not  disagree with the overall recommendations and recognized the need for  further agency action to address contractor security oversight. Objectives, Scope, and Methodology

The objectives of our review were to  Describe the information security risks associated with the federal  government’s reliance on contractors providing information technology  systems and services and other users with privileged access to federal  data and systems federal information or access federal information  systems. Identify methods used by federal agencies to ensure security of  information and information systems that are operated, used, or  accessed by contractors and other users with privileged access to  federal data. Discuss what steps the administration is taking to ensure  implementation and oversight of security of information and  information systems that are operated, used, or accessed by contractors  and other users with privileged access to federal data. To describe the information security risks associated with the federal  government’s reliance on contractors and other organizations, we analyzed  existing federal regulations, laws, and guidelines such as the Federal  Acquisition Regulation (FAR); Federal Information Security Management  Act of 2002 (FISMA); and National Institute of Standards and Technology  (NIST) guidance. We also reviewed annual chief information officer and  inspectors general FISMA reports to assess progress made in meeting  FISMA requirements related to contractor security.
Why GAO Did This Study

The federal government increasingly relies on information technology (IT) systems to provide essential services affecting the health, economy, and defense of the nation. To assist in providing these important services, the federal government relies extensively on contractors to provide IT services and systems. In addition to contractors that provide systems and services to the federal government, other organizations possess or use federal information or have access to federal information systems. These other organizations with privileged access to federal data and systems can include grantees, state and local governments, and research and educational institutions. The Office of Management and Budget (OMB) cited contractor security as a governmentwide challenge in a 2001 information security report to Congress. Recognizing the need for agencies to have effective information security programs, Congress passed the Federal Information Security Management Act of 2002 (FISMA), which provides the overall framework for ensuring the effectiveness of information security controls that support federal operations and assets. FISMA requirements apply to all federal contractors and organizations or sources that possess or use federal information or that operate, use, or have access to federal information systems on behalf of an agency. Our objectives were to (1) describe the information security risks associated with the federal government's reliance on contractor-provided IT systems and services and other users with privileged access to federal data and systems; (2) identify methods used by federal agencies to ensure security of information and information systems that are operated, used, or accessed by contractors and other users with privileged access to federal data; and (3) discuss steps the administration is taking to ensure implementation and oversight of security of information and information systems that are operated, used, or accessed by contractors and other users with privileged access to federal data and systems.

What GAO Found

Contractors and users with privileged access to federal data and systems provide valuable services that contribute to the efficient functioning of the government, but a range of risks (including operational, strategic, and legal) must be managed effectively. Most agencies recognize risks to the confidentiality, integrity, and availability of their information and systems associated with the use of contractors and other users with privileged access to federal data and systems. For example, malicious code can be inserted into agency software and systems. In addition, agencies also reported specific risks when contractors develop software or perform work at off-site facilities. Federal agencies reported additional risks to their operations posed by other users with privileged access to federal data and systems, such as lack of controlled network connections, poor access controls, and the introduction of viruses and worms. Agencies use contracts, policies, and self-assessments for ensuring information security oversight of contractors; however, each of these methods has limitations and needs further strengthening. Most agencies reported using contract language to establish information security requirements for contractors. However, agency-provided contract language generally did not address key elements of FISMA, such as annual testing of controls. In addition, the majority of agencies reported having information security policies for contractors and almost two-thirds of the agencies reported having such policies for other users with privileged access to federal data. Yet our analysis of agency-provided policies found that only 5 agencies had established policies that specifically addressed information security oversight of contractor-provided systems. Finally, the majority of agencies reported using the NIST self-assessment tool to assess contractor security capabilities. However, only 10 reported using the tool to assess the security implemented by other users with privileged access to federal data. The administration continues in its efforts to improve information security oversight of contractors, but challenges remain. For example, efforts to update the Federal Acquisition Regulation (FAR) to include the information security requirements of FISMA (which would be reflected in all relevant government contracts) have been under way since 2002, but are not yet complete. OMB continues to gather data about the number of agency systems, including those that are operated by contractors, and how many have been reviewed using a self-assessment tool. However, the data submitted showed that several agencies' chief information officers and inspectors general disagreed on the number of contractor or agency systems by as many as 100 systems or more. In addition, the data collected by OMB does not address other users with privileged access to federal data or the quality of the self assessments. Finally, NIST has developed guidance, parts of which are relevant to contractor security oversight. However, unified governmentwide guidance for overseeing information security of contractors and other users with privileged access to federal data and systems has not been issued.