This act mandated the merger of 22 federal agencies  and organizations into DHS. Each directorate is responsible for its specific  homeland security mission area. DHS Has Developed and Documented an Information Security Program, but Weaknesses in Implementation Remain

Since DHS became operational in March 2003, the CISO has developed and  documented departmental policies and procedures that could provide a  framework for implementing an agencywide information security program;  however, certain DHS components had not yet fully implemented key  information security practices and controls, as required by the program. These actions include  development, documentation, and dissemination of DHS information  security policies and procedures, strategic program plans, risk  management plans, and a management directive and handbook for the  components’ use in implementing the requirements of the program;  establishment of Information System Security Managers and  Information System Security Officers positions to implement DHS’s  information security program departmentwide;  documentation and issuance of specific guides to assist security  managers and security officers in aligning their individual components’  information security programs with the department’s program;  development of Trusted Agent FISMA and a digital dashboard as tools to  aggregate and report component and department level data for  enterprise management and oversight of the departmentwide  information security program; Trusted Agent FISMA is an enterprise  compliance and oversight tool that manages the collection and reporting  of the components’ information associated with key information  security practices and controls, and the digital dashboard aggregates the  data collected in Trusted Agent FISMA and is used as a visual tool using  a traffic light display to gauge the progress of the departmentwide  information security program; and  development and documentation of a departmentwide systems  inventory methodology that is designed to be used to develop, maintain,  and annually update an inventory of information systems operated by  the department or under its control. However, we identified that risk assessments  were not complete, security plans lacked required elements, test and  evaluation of security controls were either not comprehensive or not  performed, plans of action and milestones lacked required elements, and  continuity of operations plans were not complete, lacked required  elements, or had not been tested. In addition, DHS had not yet fully  developed a complete and accurate information systems inventory. Identifying and assessing information security risks are essential steps in  determining what controls are required and what level of resources should  be expended on controls. Until  DHS has a complete and accurate systems inventory, DHS will be inhibited  in its ability to oversee and manage the information and information  systems that support the operations and assets of the agency. Management Oversight Needs Improvement

Shortfalls in executing the responsibilities for ensuring compliance with  the departmentwide information security program allowed the weaknesses  that we identified to occur. Conclusions

DHS has not fully implemented a comprehensive, departmentwide  information security program, thereby jeopardizing the confidentiality,  integrity, and availability of the information and information systems that it  relies on to accomplish its mission.
Why GAO Did This Study

The Homeland Security Act of 2002 mandated the merging of 22 federal agencies and organizations to create the Department of Homeland Security (DHS), whose mission, in part, is to protect our homeland from threats and attacks. DHS relies on a variety of computerized information systems to support its operations. GAO was asked to review DHS's information security program. In response, GAO determined whether DHS had developed, documented, and implemented a comprehensive, departmentwide information security program.

What GAO Found

DHS has not fully implemented a comprehensive, departmentwide information security program to protect the information and information systems that support its operations and assets. It has developed and documented departmental policies and procedures that could provide a framework for implementing such a program; however, certain departmental components have not yet fully implemented key information security practices and controls. For example, risk assessments--needed to determine what controls are necessary and what level of resources should be expended on them--were incomplete. Elements required for information system security plans--which would provide a full understanding of existing and planned information security requirements--were missing. Testing and evaluation of security controls--which are needed to determine the effectiveness of information security policies and procedures--were incomplete or not performed. Elements required for remedial action plans--which would identify the resources needed to correct or mitigate known information security weaknesses--were missing, as were elements required for continuity of operations plans to restore critical systems in case of unexpected events. In addition, DHS had not yet fully developed a complete and accurate systems inventory. Shortfalls in executing responsibilities for ensuring compliance with the information security program allowed these weaknesses to occur. Although DHS has an organization that is responsible for overseeing the component implementation of key information security practices and controls, its primary means for doing so--an enterprisewide tool--has not been reliable. Until DHS addresses weaknesses with using the tool and implements a comprehensive, departmentwide information security program, its ability to protect its information and information systems will be limited.