	Objectives, Scope, and Methodology

In response to your request, our objectives were to   identify existing governmentwide requirements and guidelines for  certifying and accrediting federal information systems,   determine the extent to which federal agencies have reported that their  information systems are certified and accredited, and  assess whether agencies’ certification and accreditation processes  provide (1) consistent and comparable results, and (2) adequate  information for authorizing officials to understand risks and make  informed decisions. Elements of the certification and accreditation  process described by this guidance include the following:   Roles and responsibilities. FISMA-Required Standards Are Incorporated

FISMA-required standards issued by NIST are incorporated as an integral  part of the new certification and accreditation process. Reported Percentages of Systems Certified and Accredited Vary Widely

For the 24 agencies we surveyed, the average percentage of systems  authorized after certification and accreditation was 63 percent for the first  half of fiscal year 2004. However, the status at individual agencies was  mixed, with six reporting that they have certified and accredited less than  half of their systems. Further, there are other factors that lessen  the usefulness of these and other FISMA performance data, including the  limited assurance of data reliability and quality and the need to refine  reporting requirements to provide better information on the status of  agencies’ information security efforts. Processes at Selected Agencies Do Not Ensure Consistent or Adequate Information

Although agencies responding to our survey indicated that their  certification and accreditation processes required that specific criteria  identified in federal guidance be met, our review of certification and  accreditation documentation for selected systems at four agencies, as well  as IG FISMA evaluations for fiscal year 2003, noted instances in which  agencies do not consistently meet such criteria as a current risk  assessment and security control evaluation. Funding and staffing issues were most commonly indicated,  including those associated with implementing the new NIST guidance. Unless such criteria are met, agencies cannot ensure that  accrediting officials are receiving consistent information on which to base  their decisions, and the value of this process as a management control for  ensuring information system security is limited. Further, to improve the consistency and reliability of agency FISMA  reporting for administration and congressional oversight, we recommend  that the OMB Director consider changes to OMB’s FISMA reporting  guidance that would  provide additional clarification that national security systems are to be  reflected in reporting performance measurement data and that only  systems granted full  authorization to operate should be considered in  reporting the number of systems certified and accredited;   require reporting on key aspects of agencies’ certification and  accreditation processes and efforts, such as how agencies ensure the  quality and consistency of their certifications and accreditations and the  status of their efforts according to levels of risk or impact established  for their systems; and  encourage the IGs to assess agency FISMA reporting processes and test  agency-reported performance data as part of their FISMA-mandated  independent evaluations; for example, the IGs could review the quality  of agency certifications and accreditations for the subset of systems  they evaluate to determine whether they  meet appropriate criteria and  determine whether such information is accurately reflected in the  agencies’ compilation of related performance measures. Comments from all these agencies have been  incorporated into the report, as appropriate.
Why GAO Did This Study

The Office of Management and Budget (OMB) requires agencies to certify the security controls of their information systems and to formally authorize and accept the risk associated with their operation (a process known as accreditation). These processes support requirements of the Federal Information Security Management Act of 2002 (FISMA). Further, OMB requires agencies to report the number of systems authorized following certification and accreditation as one of the key FISMA performance measures. In response to the Congressional request, GAO (1) identified existing governmentwide requirements and guidelines for certifying and accrediting information systems, (2) determined the extent to which agencies have reported their systems as certified and accredited, and (3) assessed whether their processes provide consistent, comparable results and adequate information for authorizing officials.

What GAO Found

The National Institute of Standards and Technology (NIST) and other agencies, including the Department of Defense, have provided guidance for the certification and accreditation of federal information systems. This guidance includes new guidelines just issued by NIST, which emphasize a model of continuous monitoring, as well as compliance with FISMA-required standards for minimum-security controls. Many agencies report that they have begun to use the new guidance in their certification and accreditation processes. The reported percentage of systems certified and accredited for operation as of the first half of 2004 was 63 percent for 24 major federal agencies. However, the picture is not uniform across the government, with 7 of the agencies reporting greater than 90 percent of their systems certified and accredited but 6 reporting fewer than half. GAO's analyses also highlighted instances in which agencies do not consistently report FISMA performance measurement data, as well as other factors that lessen the usefulness of these data, such as the limited assurance of data reliability and quality. All the agencies GAO surveyed reported that their certification and accreditation processes met criteria consistent with those identified in federal guidance, such as a current risk assessment and security control evaluation. However, our review of documentation for the certification and accreditation of 32 selected systems at four of these agencies showed that these criteria were not always met--results similar to those found by agency inspectors general. Further, three of these four agencies did not have routine quality review processes to determine whether such criteria are met--processes that could help agency accrediting officials receive consistent information on which to base their decisions. Several agencies cited obstacles in implementing their certification and accreditation processes, including resource and staffing limitations. Some agencies have taken actions to improve their processes, such as redefining system boundaries to better manage systems.