By mitigating known information security  weaknesses and ensuring that information security controls are  consistently applied, FDIC could continue to reduce risks and better  protect its sensitive financial information and resources from inadvertent  or deliberate misuse, improper modification, unauthorized disclosure, or  destruction. FDIC improved controls for identifying and authenticating the identity of  users by implementing its policy on password controls over the Portfolio  Investment Accounting (PORTIA) application. During 2015, FDIC improved controls for authorizing users’ access. Although FDIC strengthened authorization controls by implementing most  of the unresolved recommendations, the corporation did not have an effective process for performing periodic reviews of user  access rights for several systems supporting the corporation’s  financial processing,  consistently disable accounts belonging to users who had not  accessed a financial system in a predefined period of time,  consistently document that modifications to user access to systems  had been authorized before making the changes, and  identify authorization and recertification deficiencies during its  oversight of an outsourced system. However, the corporation  had not yet fully implemented procedures for applying patches,  including critical patches, to remediate known vulnerabilities in third  party software on systems supporting financial processing. Many Information Security Program Activities Were Implemented, but Further Improvements Are Needed

A key reason for the information security weaknesses in FDIC’s financial  systems was that, although the corporation had a comprehensive  framework for its information security program, some aspects were not  fully implemented. FISMA requires  each agency to develop, document, and implement an information  security program that, among other things, includes periodic assessments of risk, including the magnitude of harm that  could result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems  that support the operations and assets of the organization; policies and procedures that are based on risk assessments, cost- effectively reduce information security risks to an acceptable level,  and ensure that information security is addressed throughout the life  cycle of each organizational information system; provide specialized training to personnel with significant security periodic testing and evaluation of the effectiveness of information  security policies, procedures, practices, and security controls to be  performed with a frequency depending on risk, but no less than  annually; and a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in the information  security policies, procedures, and practices of the organization. The corporation concurred with the  recommendation. During 2015, FDIC had resolved 7 of the 16 previously- reported security weaknesses that were unresolved as of December  31, 2014. Specifically, the  corporation did not (1) fully document and implement procedures for  performing system access requests, assignments, and removal or (2)  have a policy for monitoring critical security file changes. Given the role  that information systems play in FDIC’s internal controls over financial  reporting, it is important that the corporation address the remaining  weaknesses in information security controls that we and the Office of  Inspector General identified—both old and new—as part of its ongoing  efforts to mitigate the risks from cyber attacks and to ensure the  confidentiality, integrity, and availability of its financial and sensitive  information. Although we do not consider these weaknesses individually  or collectively to be either a material weakness or a significant deficiency  for financial reporting purposes, the corporation will have limited  assurance that its sensitive financial information and resources will be  secure until these weaknesses have been mitigated. Appendix I: Objective, Scope, and Methodology

The objective of this information security review was to determine the  effectiveness of the Federal Deposit Insurance Corporation’s (FDIC)  controls in protecting the confidentiality, integrity, and availability of its  financial systems and information. The review was  conducted as part of our audit of the FDIC financial statements of the  Deposit Insurance Fund and the Federal Savings and Loan Insurance  Corporation Resolution Fund.
Why GAO Did This Study

FDIC has a demanding responsibility enforcing banking laws, regulating financial institutions, and protecting depositors. Because of FDIC's reliance on information systems, effective information security controls are essential to ensure that the corporation's systems and information are adequately protected from inadvertent or deliberate misuse, improper modification, unauthorized disclosure, or destruction.
As part of its audit of the 2015 financial statements of the Deposit Insurance Fund and the Federal Savings and Loan Insurance Corporation Resolution Fund administered by FDIC, GAO assessed the effectiveness of the corporation's controls in protecting the confidentiality, integrity, and availability of its financial systems and information. To do so, GAO examined security policies, procedures, reports, and other documents; tested controls over key financial applications; and interviewed FDIC personnel.

What GAO Found

The Federal Deposit Insurance Corporation (FDIC) has implemented numerous information security controls intended to protect its key financial systems; however, weaknesses remain that place the confidentiality, integrity, and availability of financial systems and information at risk. During calendar year 2015, the corporation continued to devote attention to securing its financial information and systems that support its mission. Key among its actions were improving controls for identifying and authenticating the identity of users and improving controls for authorizing users' access. However, FDIC continues to have unremediated weaknesses. For example, the corporation (1) did not have an effective process for recertifying user access rights to several systems supporting the corporation's financial processing and (2) had not yet applied critical patches to mitigate known vulnerabilities in third party software on systems supporting financial processing.
Although the corporation had a comprehensive framework for its information security program, some aspects were not fully implemented. For example, the corporation did not (1) fully document and implement procedures for performing system access requests, assignments, and removal and (2) have a policy for monitoring critical file changes. In addition, FDIC had yet to fully address 9 previously-reported weaknesses that were unresolved as of December 31, 2014, as indicated in the following table.
While newly-identified weaknesses, along with those previously identified that remain uncorrected, are not individually or collectively a material weakness or a significant deficiency for financial reporting purposes, the corporation will have limited assurance that its sensitive financial information and resources will be secure until these weaknesses have been mitigated.

What GAO Recommends

In addition to the 9 prior recommendations that have not been fully addressed, GAO is making 2 recommendations to improve FDIC's implementation of its information security program. In a separate report with limited distribution, GAO is making 10 new recommendations to FDIC to address newly-identified weaknesses in access controls. FDIC concurred with GAO's recommendations.