In this regard, FISMA requires that agencies implement  information security programs that, among other things, include    periodic assessments of the risk;  risk-based policies and procedures;   subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems, as  appropriate;   security awareness training for agency personnel, including contractors  and other users of information systems that support the operations and  assets of the agency;    periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, performed with a frequency depending  on risk, but no less than annually;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies;   procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations. OMB has  provided instructions to federal agencies and their IGs for preparing  annual FISMA reports. Agencies Report Progress in Performing Control Activities, but Some IGs Report that Weaknesses Exist

Major federal agencies have continued to report steady progress over the  past several years in performing information security control activities,  although IGs at several agencies identified inconsistencies with reported  information. According to OMB and agency FISMA reports, the federal  government continued to improve information security performance in  fiscal year 2007 relative to key performance metrics established by OMB. 1). In addition, IGs at several agencies sometimes disagreed with the  information reported by the agency and have identified weaknesses in the  processes used to implement these and other security program activities. 3). Certification and Accreditation

Federal agencies continue to report an increasing percentage of systems  that have been certified and accredited. Most agencies did not implement controls to sufficiently prevent, limit, or  detect access to computer networks, systems, or information. However, 22 agencies did not always configure network devices and  services to prevent unauthorized access and ensure system integrity, or  patch key servers and workstations in a timely manner. In addition, 18  agencies did not always segregate incompatible duties to different  individuals or groups so that one individual does not control all aspects of  a process or transaction. Agencywide Security Programs Were Not Fully Implemented

An underlying cause for information security weaknesses identified at  federal agencies is that they have not yet fully or effectively implemented  all the FISMA-required elements for an agencywide information security  program. Our  analysis determined that 21 of 24 major federal agencies had weaknesses  in their agencywide information security programs. Consequently, federal systems and information are at increased risk of  unauthorized access to and disclosure, modification, or destruction of  sensitive information, as well as inadvertent or deliberate disruption of  system operations and services. Opportunities Exist for Enhancing Federal Information Security

In prior reports, GAO and IGs have made hundreds of recommendations to  agencies for actions necessary to resolve prior significant control  deficiencies and information security program shortfalls. The Information Systems Security Line of Business: The goal of this  initiative is to improve the level of information systems security across  government agencies and reduce costs by sharing common processes and  functions for managing information systems security. Opportunities also exist to enhance policies and practices related to  security control testing and evaluation, FISMA reporting, and the  independent annual evaluations of agency information security programs  required by FISMA. As a result, OMB and Congress lack  information that could identify governmentwide issues regarding patch  management. In summary, agencies have reported progress in implementing control  activities, but persistent weaknesses in agency information security  controls threaten the confidentiality, integrity, and availability of federal  information and information systems, as illustrated by the increasing  number of reported security incidents. Opportunities exist to improve  information security at federal agencies. OMB and certain federal agencies  have initiated efforts that are intended to strengthen the protection of  federal information and information systems.
Why GAO Did This Study

Information security is especially important for federal agencies, where the public's trust is essential and poor information security can have devastating consequences. Since 1997, GAO has identified information security as a governmentwide high-risk issue in each of our biennial reports to Congress. Concerned by reports of significant weaknesses in federal computer systems, Congress passed the Federal Information Security Management Act (FISMA) of 2002, which permanently authorized and strengthened information security program, evaluation, and annual reporting requirements for federal agencies. GAO was asked to testify on the current state of federal information security and compliance with FISMA. This testimony summarizes (1) the status of agency performance of information security control activities as reported by major agencies and their inspectors general (IG), (2) the effectiveness of information security at federal agencies, and (3) opportunities to improve federal information security. In preparing for this testimony, GAO analyzed agency, IG, Office of Management and Budget (OMB), and GAO reports on information security and reviewed OMB FISMA reporting instructions, information technology security guidance, and information on reported security incidents.

What GAO Found

Over the past several years, 24 major federal agencies have consistently reported progress in performing information security control activities in their annual FISMA reports. For fiscal year 2007, the federal government continued to report improved information security performance relative to key performance metrics established by OMB. For example, an increasing percentage of systems governmentwide had been tested and evaluated, had tested contingency plans, and had been certified and accredited. However, IGs at several agencies sometimes disagreed with the agency reported information and identified weaknesses in the processes used to implement these and other security program activities. Despite agency reported progress, major federal agencies continue to experience significant information security control deficiencies that limit the effectiveness of their efforts to protect the confidentiality, integrity, and availability of their information and information systems. Most agencies did not implement controls to sufficiently prevent, limit, or detect access to computer networks, systems, or information. In addition, agencies did not always effectively manage the configuration of network devices to prevent unauthorized access and ensure system integrity, patch key servers and workstations in a timely manner, assign duties to different individuals or groups so that one individual did not control all aspects of a process or transaction, and maintain complete continuity of operations plans for key information systems. An underlying cause for these weaknesses is that agencies have not fully or effectively implemented agencywide information security programs. As a result, federal systems and information are at increased risk of unauthorized access to and disclosure, modification, or destruction of sensitive information, as well as inadvertent or deliberate disruption of system operations and services. Such risks are illustrated, in part, by an increasing number of security incidents experienced by federal agencies. Nevertheless, opportunities exist to bolster federal information security. Federal agencies could implement the hundreds of recommendations made by GAO and IGs to resolve prior significant control deficiencies and information security program shortfalls. In addition, OMB and other federal agencies have initiated several governmentwide initiatives that are intended to improve security over federal systems and information. For example, OMB has established an information systems security line of business to share common processes and functions for managing information systems security and directed agencies to adopt the security configurations developed by the National Institute of Standards and Technology and Departments of Defense and Homeland Security for certain Windows operating systems. Opportunities also exist to enhance policies and practices related to security control testing and evaluation, FISMA reporting, and the independent annual evaluations of agency information security programs required by FISMA.