Specifically, it requires information security programs that, among other  things, include    periodic assessments of the risk and magnitude of harm that could result  from the unauthorized access, use, disclosure, disruption, modification, or  destruction of information or information systems; risk-based policies and procedures that cost effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system;   subordinate plans, for providing adequate information security for  networks, facilities, and systems or groups of information systems, as  appropriate;   security awareness training for agency personnel, including contractors  and other users of information systems that support the operations and  assets of the agency;   periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, performed with a frequency depending  on risk, but no less than annually, and that includes testing of  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information systems;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency;   procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. Incidents Place Sensitive Information at Risk

Since January 2006, federal agencies have reported a spate of security  incidents that have put sensitive data at risk, including the theft, loss, or  improper disclosure of personally identifiable information on millions of  Americans, thereby exposing them to loss of privacy and potential harm  associated with identity theft. As discussed later in this report, OMB has issued guidance that largely  addresses these lessons. Weaknesses Persist at Federal Agencies in Implementing Security Policies and Practices

As illustrated by recent security incidents, significant weaknesses  continue to threaten the confidentiality, integrity, and availability of  critical information and information systems used to support the  operations, assets, and personnel of federal agencies. As a result, there is increased risk that  sensitive data and personally identifiable information may be  compromised. For instance, agencies did not prepare key security reports  such as failed login attempt reports. For example, many agencies did not consistently  configure network devices and services to prevent unauthorized access  and ensure system integrity, such as installing critical software patches in  a timely manner. As a result, agencies’ cannot ensure that appropriate controls  are in place to protect key systems and critical information. IRS had  not consistently implemented effective access controls to prevent, limit, or  detect unauthorized access to computing resources from within its  internal network. Agencies Report Progress, but More Work Is Needed in Implementing Requirements

Federal agencies continue to report steady progress in implementing key  information security requirements. However, IGs at  several agencies sometimes disagreed with the information reported by  the agency and have identified weaknesses in the processes used to  implement these and other security program activities. In addition, agencies may not be fully aware of the security  control weaknesses in their systems, thereby leaving the agencies’  information and systems vulnerable to attack or compromise. In response, OMB has  taken steps to enhance its reporting instructions. However, the metrics specified in current  reporting guidance do not measure how effectively agencies are  performing various activities and the guidance does not address a key  activity. The absence of this information could result in reporting that  does not adequately reflect the status of agency implementation of  required information security policies and procedures. Require agencies to report on a key activity—patch management. Appendix I: Objectives, Scope, and Methodology

In accordance with the Federal Information Security Management Act of  2002 (FISMA) requirement that the Comptroller General report  periodically to Congress, our objectives were to evaluate (1) the adequacy  and effectiveness of agencies’ information security policies and practices  and (2) federal agency implementation of FISMA requirements.
Why GAO Did This Study

For many years, GAO has reported that weaknesses in information security are a widespread problem with potentially devastating consequences--such as intrusions by malicious users, compromised networks, and the theft of personally identifiable information--and has identified information security as a governmentwide high-risk issue. Concerned by reports of significant vulnerabilities in federal computer systems, Congress passed the Federal Information Security Management Act of 2002 (FISMA), which permanently authorized and strengthened the information security program, evaluation, and reporting requirements for federal agencies. As required by FISMA to report periodically to Congress, in this report GAO discusses the adequacy and effectiveness of agencies' information security policies and practices and agencies' implementation of FISMA requirements. To address these objectives, GAO analyzed agency, inspectors general (IG), Office of Management and Budget (OMB), congressional, and GAO reports on information security.

What GAO Found

Significant weaknesses in information security policies and practices threaten the confidentiality, integrity, and availability of critical information and information systems used to support the operations, assets, and personnel of most federal agencies. Recently reported incidents at federal agencies have placed sensitive data at risk, including the theft, loss, or improper disclosure of personally identifiable information on millions of Americans, thereby exposing them to loss of privacy and identity theft. Almost all of the major federal agencies had weaknesses in one or more areas of information security controls. Most agencies did not implement controls to sufficiently prevent, limit, or detect access to computer resources. In addition, agencies did not always manage the configuration of network devices to prevent unauthorized access and ensure system integrity, such as patching key servers and workstations in a timely manner; assign incompatible duties to different individuals or groups so that one individual does not control all aspects of a process or transaction; or maintain or test continuity of operations plans for key information systems. An underlying cause for these weaknesses is that agencies have not fully implemented their information security programs. As a result, agencies may not have assurance that controls are in place and operating as intended to protect their information resources, thereby leaving them vulnerable to attack or compromise. Nevertheless, federal agencies have continued to report steady progress in implementing certain information security requirements. For fiscal year 2006, agencies generally reported performing various control activities for an increasing percentage of their systems and personnel. However, IGs at several agencies disagreed with the information the agency reported and identified weaknesses in the processes used to implement these activities. Further, although OMB enhanced its reporting instructions to agencies for preparing fiscal year 2006 FISMA reports, the metrics specified in the instructions do not measure how effectively agencies are performing various activities, and there are no requirements to report on a key activity. As a result, reporting may not adequately reflect the status of agency implementation of required information security policies and procedures.