Specifically, this program is to include    periodic assessments of the risk and magnitude of harm that could result  from the unauthorized access, use, disclosure, disruption, modification, or  destruction of information or information systems;  risk-based policies and procedures that cost-effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system;   subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems;   security awareness training for agency personnel, including contractors  and other users of information systems that support the operations and  assets of the agency;   periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, performed with a frequency depending  on risk, but no less than annually, and that includes testing of  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information systems;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency;   procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. OMB’s Report to Congress Notes Progress and Challenges

In its FY 2003 Report to Congress on Federal Government Information  Security Management, published this month, OMB concludes that the  federal government has made significant strides in identifying and  addressing long-standing problems, but that challenging weaknesses  remain. The report also presents a  plan of action that OMB is pursuing with agencies to close these gaps and  improve the security of federal information and systems. This plan is  intended to resolve information and security challenges through both  management and budgetary processes. 2. 3. 4. The report emphasizes that even with the strong focus of  both GISRA and FISMA on the responsibilities of agency officials  regarding security, there continues to be a lack of understanding, and  therefore, accountability within the federal government. FISMA Reports Highlight Overall Increases in Performance Measures, But Individual Agency Results Vary Widely

Overall, fiscal year 2003 data reported by the agencies for a subset of  OMB’s performance measures show increasing numbers of systems  meeting the requirements represented by these measures. For example, as  shown in table 1, the reported percentage of systems authorized for  processing following certification and accreditation increased from 47  percent for fiscal year 2002 to 62 percent for fiscal year 2003—an increase  of 15 percentage points. Also as  discussed later, we noted opportunities to improve the usefulness of  agency-reported data. However, according to their fiscal year 2003 FISMA reports,  only 13 of the 24 agencies reported that they had completed their system  inventories. Performance  measurement data are reported on the total number of agency systems and  do not indicate the relative importance or risk of the systems for which  FISMA requirements have been met. Status of NIST Efforts

Since FISMA was enacted in December 2002, NIST has taken a number of  actions to develop required security-related standards and guidance. Current budget constraints may, however, affect NIST’s future work.
Why GAO Did This Study

For many years, GAO has reported on the widespread negative impact of poor information security within federal agencies and has identified it as a governmentwide high-risk issue since 1997. Legislation designed to improve information security was enacted in October 2000. It was strengthened in December 2002 by new legislation, the Federal Information Security Management Act of 2002 (FISMA), which incorporated important new requirements. This testimony discusses (1) the Office of Management and Budget's (OMB) recent report to the Congress required by FISMA on the government's overall information security posture, (2) the reported status of efforts by 24 of the largest agencies to implement federal information security requirements, (3) opportunities for improving the usefulness of performance measurement data, and (4) progress by the National Institute of Standards and Technology (NIST) to develop related standards and guidance.

What GAO Found

OMB reports significant strides in addressing long-standing problems, but at the same time cites challenging weaknesses that remain. One governmentwide weakness OMB emphasizes is a lack of understanding--and therefore accountability--on the part of agency officials regarding their responsibilities for ensuring the security of information and systems. The report presents a plan of action to close these gaps through both management and budgetary processes. Fiscal year 2003 FISMA data showed that, overall, the 24 federal agencies reported increasing numbers of their systems met the information security requirements represented by key OMB performance measures. For example, of the total number of systems reported by these agencies, the reported number assessed for risk climbed from 65 percent to 78 percent, those having a contingency plan jumped from 55 to 68 percent, and those authorized for processing following certification and accreditation rose from 47 to 62 percent. However, reported results varied widely among individual agencies, with some reporting that less than half of their systems met certain requirements. Further, GAO noted opportunities to improve the usefulness of reported performance management data, including independent validation of these data and completion of system inventories. Reported Performance Measurement Data for Selected Information Security Requirements for 24 Large Federal Agencies NIST made progress in developing security-related standards and guidance required by FISMA. These include standards to categorize systems according to potential impact in the event of a security breach and recommended controls for such systems. However, according to NIST, current and future funding constraints could threaten its information security work.