Specifically, FISMA requires information security programs to  include, among other things    periodic assessments of the risk that could result from the compromise of  information or information systems;  risk-based policies and procedures that cost-effectively reduce  information security risks to an acceptable level;   subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems;   security awareness training for agency personnel, including contractors;    periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies;   procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations; and    an annually updated inventory of major information systems operated by  the agency or under its control. Weaknesses in Information Security Controls Place Sensitive Information at Risk

Significant weaknesses in information security policies and practices  expose sensitive data to significant risk, as illustrated by recent incidents  at various agencies. In their fiscal year  2008 performance and accountability reports, 20 of 24 major agencies  noted that their information system controls over their financial systems  and information were either a material weakness or a significant  deficiency (see fig. 2). Over the last several years, most agencies have not implemented controls  to sufficiently prevent, limit, or detect access to computer networks,  systems, or information. An underlying cause for information security weaknesses identified at  federal agencies is that they have not yet fully or effectively implemented  key elements for an agencywide information security program, as required  by FISMA. Twenty-three of the 24 major federal agencies had weaknesses in their  agencywide information security programs. Agencies Continue to Report Progress in Implementing Requirements

Federal agencies reported increased compliance in implementing key  information security control activities for fiscal year 2008; however,  inspectors general at several agencies noted shortcomings with agencies’  implementation of information security requirements. Specifically,  agencies reported increases in the number and percentage of systems that  had been certified and accredited, the number and percentage of  employees and contractors receiving security awareness training, and the  number and percentage of systems with tested contingency plans. However, the number and percentage of systems that had been tested and  evaluated at least annually decreased slightly (from 95 percent in fiscal  year 2007 to 93 percent in fiscal year 2008) and the number and percentage  of employees who had significant security responsibilities and had  received specialized training decreased significantly (from 90 percent in  fiscal year 2007 to 76 percent in 2008). Each year, OMB provides instructions  to federal agencies and their inspectors general for FISMA annual  reporting. Additionally, OMB summarizes the information provided by the  agencies and the inspectors general in its report to Congress. This information could be useful in determining whether agencies are  effectively implementing information security policies, procedures, and  practices. In addition, OMB did not include key information about findings and  significant deficiencies identified by inspectors general in its  governmentwide report to Congress and did not approve or disapprove  agency information security programs.
Why GAO Did This Study

Without proper safeguards, federal agencies' computer systems are vulnerable to intrusions by individuals and groups who have malicious intentions and can obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. Concerned by reports of significant weaknesses in federal systems, Congress passed the Federal Information Security Management Act (FISMA), which permanently authorized and strengthened information security program, evaluation, and annual reporting requirements for federal agencies. GAO was asked to testify on its draft report on (1) the adequacy and effectiveness of federal agencies' information security policies and practices and (2) their implementation of FISMA requirements. To prepare for this testimony, GAO summarized its draft report where it analyzed agency, inspectors general, Office of Management and Budget (OMB), congressional, and GAO reports on information security.

What GAO Found

Significant weaknesses in information security policies and practices expose sensitive data to significant risk, as illustrated by recent incidents at various agencies. GAO's audits and reviews by inspectors general note significant information security control deficiencies that place agency operations and assets at risk. In their fiscal year 2008 performance and accountability reports, 20 of 24 major agencies noted that the information system controls over their financial systems and information were either a significant deficiency or a material weakness. In addition, over the last several years, most agencies have not implemented controls to sufficiently prevent, limit, or detect access to computer networks, systems, or information. An underlying cause for information security weaknesses identified at federal agencies is that they have not yet fully or effectively implemented key elements for an agencywide information security program, as required by FISMA. Twenty-three of the 24 major federal agencies had weaknesses in their agencywide information security programs. Federal agencies reported increased compliance in implementing key information security control activities for fiscal year 2008; however, inspectors general at several agencies noted shortcomings with agencies' implementation of information security requirements. For fiscal year 2008 reporting, agencies reported higher levels of FISMA implementation for most information security metrics and lower levels for others. Increases were reported in the number and percentage of employees and contractors receiving security awareness training, the number and percentage of systems with tested contingency plans, and the number and percentage of systems that were certified and accredited. However, the number and percentage of employees who had significant security responsibilities and had received specialized training decreased significantly and the number and percentage of systems that had been tested and evaluated at least annually decreased slightly. In addition, the current reporting instructions do not request inspectors general to report on agencies' effectiveness of key activities and did not always provide them with clear guidance for annual reporting. This information could be useful in determining whether agencies are effectively implementing information security policies, procedures, and practices. Without such information, Congress may not be fully informed about the state of federal information security.