More specifically, FISMA requires each agency to develop, document,  and provide an information security program that includes the following  components: periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems; policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements;  subordinate plans for providing adequate information security for  networks, facilities, and systems or group of information systems, as  appropriate;  security awareness training to inform personnel of information security  risks and of their responsibilities in implementing agency policies and  procedures, as well as training personnel with significant security  responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems; a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency. Selected Small Agencies Have Made Mixed Progress in Implementing Federal Information Security and Privacy Requirements

Although the small agencies we reviewed have taken steps to develop  information security and privacy programs, weaknesses existed that  threatened the confidentiality, integrity, and availability of their information  and systems. For example, while most of the six  agencies designated a privacy official, not all the agencies completed  privacy impact assessments. In a separate report for limited official use only, we are providing specific  details on the weaknesses in the six selected agencies’ implementation of  information security requirements. Specifically, OMB and DHS are not overseeing all small agencies’  implementation of cybersecurity and privacy requirements. However, the agencies in our review have faced  challenges in using the guidance and services, and additional efforts  could better position smaller agencies to take advantage of guidance and  services offered. OMB and DHS Are Not Overseeing All Small Agencies on Information Security and Privacy Implementation

FISMA, the Privacy Act, and the E-Government Act include provisions  that require OMB to oversee the implementation of the various  information security and privacy requirements at all federal agencies. In overseeing small agencies’ implementation of information security and  privacy requirements, OMB and DHS have instructed the agencies to  report annually on a variety of metrics, which are used to gauge  implementation of the information security programs and privacy  requirements established by the various acts. OMB and DHS Provide Information Security and Privacy Guidance and Services to Federal Agencies, but Small Agencies Face Challenges in Using Them

OMB has provided guidance to federal agencies, including small  agencies, on information security and privacy. In a separate report with limited distribution, we are also making detailed  recommendations to the selected agencies in our review to correct  weaknesses identified in their information security and privacy programs. GAO staff who made key  contributions to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which (1) selected small  agencies are implementing federal information security and privacy laws  and policies, and (2) the Office of Management and Budget (OMB) and  the Department of Homeland Security (DHS) are overseeing and  assisting small agencies in implementing their information security and  privacy programs.
Why GAO Did This Study

Small federal agencies—generally those with 6,000 or fewer employees—are, like larger agencies, at risk from threats to information systems that support their operations and the information they contain, which can include personally identifiably information. Federal law and policy require small agencies to meet information security and privacy requirements and assign responsibilities to OMB for overseeing agencies' activities. OMB has assigned several of these duties to DHS.
GAO was asked to review cybersecurity and privacy at small agencies. The objectives of this review were to determine the extent to which (1) small agencies are implementing federal information security and privacy laws and policies and (2) OMB and DHS are overseeing and assisting small agencies in implementing their information security and privacy programs. GAO selected six small agencies with varying characteristics for review; reviewed agency documents and selected systems; and interviewed agency, OMB, and DHS officials.

What GAO Found

The six small agencies GAO reviewed have made mixed progress in implementing elements of information security and privacy programs as required by the Federal Information Security Management Act of 2002, the Privacy Act of 1974, the E-Government Act of 2002, and Office of Management and Budget (OMB) guidance (see figure).
*Agency 5 was not required to complete a privacy impact assessment.
In a separate report for limited official use only, GAO is providing specific details on the weaknesses in the six selected agencies' implementation of information security and privacy requirements.
OMB and the Department of Homeland Security (DHS) took steps to oversee and assist small agencies in implementing security and privacy requirements. For example, OMB and DHS instructed small agencies to report annually on a variety of metrics that are used to gauge implementation of information security programs and privacy requirements. In addition, OMB and DHS issued reporting guidance and provided assistance to all federal agencies on implementing security and privacy programs. However, 55 of 129 small agencies identified by OMB and DHS are not reporting on information security and privacy requirements. Further, the agencies in GAO's review have faced challenges in using the guidance and services offered. Until OMB and DHS oversee agencies' implementation of information security and privacy program requirements and provide additional assistance, small agencies will continue to face challenges in protecting their information and information systems.

What GAO Recommends

GAO recommends that OMB report on all small agencies' implementation of security and privacy requirements. GAO also recommends that DHS develop services and guidance targeted to small agencies' environments. GAO is making recommendations to the six agencies reviewed to address their information security and privacy weaknesses in a separate, restricted report. OMB and DHS generally concurred with the recommendations.