Thus it  is critical that federal agencies protect their systems and the information  on them and respond to data breaches and cyber incidents when they  occur. Data breaches at federal agencies have received considerable publicity  and raised concerns about the protection of PII at those agencies. In addition to establishing responsibilities for agencies, FISMA assigns  specific responsibilities to OMB, the National Institute of Standards and  Technology (NIST) and inspectors general:
OMB is to develop and oversee the implementation of policies,  principles, standards, and guidelines on information security in federal  agencies (except with regard to national security systems). In particular, with regard to the eight components of an agency-wide  security program,
18 agencies had fully implemented a program for managing  information security risk, and 6 had partially implemented such a  program;
10 agencies had fully documented security policies and procedures,  while 12 had partially documented them;
18 agencies had selected security controls for their systems, but 6  had only partially implemented this practice;
22 agencies had established a security training program, and 2 had  partially established such a program;
13 agencies were monitoring security controls on an ongoing basis,  but 10 agencies had not fully implemented a continuous monitoring  program;
19 agencies had established a program for remediating weaknesses  in their security policies, practices, and procedures, while 5 had not  fully implemented elements of a remediation program;
20 agencies had established an incident response and reporting  program, but 3 agencies had not fully established such a program;and
18 agencies had fully established a program for ensuring continuity of  operations in the event of a disruption or disaster, but 5 agencies  partially implemented a continuity of operations program. We and agency  inspectors general have continued to make numerous recommendations  to agencies aimed at improving their information security posture. Fully  implementing these recommendations will strengthen agencies’ ability to  ensure that their information, including PII, is adequately protected. Accordingly, OMB and NIST have  specified key practices for responding to PII data breaches.include management practices such as establishing a data breach  response team and training employees on roles and responsibilities for  breach response, and operational practices, such as preparing reports on   These  suspected data breaches and submitting them to appropriate internal and  external entities, assessing the likely risk of harm and level of impact of a  suspected breach, offering assistance to affected individuals (if  appropriate), and analyzing the agency’s breach response and identifying  lessons learned. Of the seven agencies we reviewed, only the Internal Revenue  Service (IRS) consistently documented both an assigned risk level  and how that level was determined for PII-related data breach  incidents; only the Army and IRS documented the number of affected  individuals for each incident; and only the Army and the Securities  and Exchange Commission notified affected individuals for all high- risk breaches. The seven agencies did not consistently offer credit monitoring to  individuals affected by PII-related breaches. Incomplete guidance from OMB contributed to this inconsistent  implementation. For example, OMB’s guidance does not make clear how  agencies should use risk levels in making a determination about  notification to affected individuals. In addition, OMB guidance for reporting on data breaches involving PII  may be too stringent. In our report, we recommended that OMB revise its guidance on federal  agencies’ response to PII-related data breaches to include (1) guidance  on notifying affected individuals based on a determination of the level of  risk; (2) criteria for determining whether to offer assistance, such as credit  monitoring, to affected individuals; and (3) revised requirements for  reporting PII-related breaches to US-CERT. We also made a number of recommendations to the individual agencies  in our review to improve their response to data breaches involving PII. As we and inspectors general have long pointed out,  federal agencies continue to face challenges in effectively implementing  all elements of their information security programs. The published product may be reproduced and distributed in its entirety  without further permission from GAO.
Why GAO Did This Study

The federal government collects large amounts of PII from the public, including taxpayer data, Social Security information, and patient health information. It is critical that federal agencies ensure that this information is adequately protected from data breaches, and that they respond swiftly and appropriately when breaches occur. Since 1997, GAO has designated information security as a government-wide high-risk area. Further, data breaches at federal agencies have raised concerns about the protection of PII. Federal laws and other guidance specify the responsibilities of agencies in securing their information and information systems and in responding to data breaches.
This testimony addresses federal agencies' efforts to secure their information and respond to data breaches. In preparing this statement, GAO relied primarily on previously published and ongoing work in this area.

What GAO Found

The number of reported information security incidents involving personally identifiable information (PII) has more than doubled over the last several years (see figure).
As GAO has previously reported, major federal agencies continue to face challenges in fully implementing all components of an agency-wide information security program, which is essential for securing agency systems and the information they contain—including PII. Specifically, agencies have had mixed results in addressing the eight components of an information security program called for by law, and most agencies had weaknesses in implementing specific security controls. GAO and inspectors general have continued to make recommendations to strengthen agency policies and practices.
In December 2013, GAO reported on agencies' responses to PII data breaches and found that they were inconsistent and needed improvement. Although selected agencies had generally developed breach-response policies and procedures, their implementation of key practices called for by Office of Management and Budget (OMB) and National Institute of Standards and Technology guidance was inconsistent. For example,
only one of seven agencies reviewed had documented both an assigned risk level and how that level was determined for PII data breaches; two agencies documented the number of affected individuals for each incident; and two agencies notified affected individuals for all high-risk breaches.
the seven agencies did not consistently offer credit monitoring to affected individuals; and
none of the seven agencies consistently documented lessons learned from their breach responses.
Incomplete guidance from OMB contributed to this inconsistent implementation. For example, OMB's guidance does not make clear how agencies should use risk levels to determine whether affected individuals should be notified. In addition, the nature and timing of reporting requirements may be too stringent.

What GAO Recommends

In its December 2013 report, GAO made 22 recommendations to the agencies included in its review aimed at improving their data breach response activities. GAO also recommended that OMB update its guidance on federal agencies' responses to PII-related data breaches. Agency responses to GAO's recommendations varied.