Most of the 24 CFO Act Agencies Exhibited Weaknesses in All Major Categories of Controls

Our reports, agency reports, and inspectors general assessments of  information security controls during fiscal year 2016 revealed that most of  the 24 agencies covered by the CFO Act had weaknesses in each of the  five major categories of information system controls: access controls—the policies and practices that limit or detect access  to computer resources (data, programs, equipment, and facilities),  thereby protecting them against unauthorized modification, loss, and  disclosure;  configuration management controls—the policies and practices that  are intended to prevent unauthorized changes to information system  resources (e.g., software programs and hardware configurations) and  to assure that software is current and known vulnerabilities are  patched;  segregation of duties—the policies, practices, and organizational  structure that prevent an individual from controlling all critical stages  of a process by splitting responsibilities between two or more  organizational groups;  contingency planning—the policies, plans, and practices that help  avoid significant disruptions in computer-dependent operations; and agencywide security management—the policies, processes, and  practices that provide a framework for ensuring that risks are  understood and that effective controls are selected, implemented, and  operating as intended. We have made  hundreds of recommendations to agencies to address these security  control deficiencies, but many have not yet been fully implemented. Inspectors General Determined That Federal Agencies Generally Did Not Have Effective Information Security Program Functions

Inspectors general evaluations of agency information security programs,  including their respective agencies’ policies and practices, determined  that most agencies did not have effective information security program  functions in fiscal year 2016. Agencies Acted to Fulfill Their FISMA- defined Roles, but Did Not Sufficiently Plan to Evaluate the Effectiveness of Their Efforts

As required in FISMA, OMB, DHS, NIST, and the agencies’ inspectors  general have ongoing and planned initiatives to support the act’s  implementation across the federal government. OMB, among other  things, oversaw and reported to Congress on agencies’ implementation of  information security policies, standards, and guidelines. NIST Continues to Provide Information Security Guidance to Agencies

According to FISMA, NIST is to develop information security standards  and guidelines, in coordination with OMB and DHS. However, the fiscal year 2017 guidance does not include a  plan or schedule to determine whether using the security capability  maturity model will provide useful results that are consistent and  comparable. Until an evaluative component is incorporated into the  implementation of the maturity model, OMB will not have reasonable  assurance that the inspectors general evaluations of agency information  security programs will have consistent and comparable results across all  federal agencies as intended. Recommendation for Executive Action

We recommend that the Director of the Office of Management and  Budget, in consultation with the Secretary of Homeland Security, and the  Chief Information Officers Council, evaluate whether the full  implementation of the capability maturity model developed by the Council  of the Inspectors General on Integrity and Efficiency ensures that  consistent and comparable results are achieved across all federal  agencies. Appendix I: Objectives, Scope, and Methodology

Our objectives were to evaluate (1) the adequacy and effectiveness of  federal agencies’ information security policies and practices and (2) the  extent to which agencies with governmentwide responsibilities have  implemented their requirements under the Federal Information Security  Management Act of 2002 as amended by the Federal Information  Security Modernization Act of 2014 (FISMA). As appropriate, we also  interviewed officials from OMB, the Department of Homeland Security  (DHS), and the National Institute of Standards and Technology (NIST).
Why GAO Did This Study

GAO first designated federal information security as a governmentwide high-risk area 20 years ago. First enacted in 2002, FISMA required federal agencies to develop, document, and implement information security programs and have independent evaluations of those programs and practices. As amended in 2014, FISMA assigns responsibilities to OMB, DHS, and NIST.
FISMA also includes a provision for GAO to periodically report to Congress on agencies' information security. The objectives of this review are to evaluate (1) the adequacy and effectiveness of agencies' information security policies and practices and (2) the extent to which agencies with governmentwide responsibilities have implemented their requirements under FISMA. GAO categorized information security-related weaknesses reported by the 24 CFO Act agencies, their IGs, and OMB according to the control areas defined in the Federal Information System Controls Audit Manual; reviewed prior GAO work; examined OMB, DHS, and NIST documents; and interviewed agency officials.

What GAO Found

During fiscal year 2016, federal agencies continued to experience weaknesses in protecting their information and information systems due to ineffective implementation of information security policies and practices. Most of the 24 Chief Financial Officers Act (CFO) agencies had weaknesses in five control areas—access controls, configuration management controls, segregation of duties, contingency planning, and agencywide security management (see figure). GAO and inspectors general (IGs) evaluations of agency information security programs, including policies and practices, determined that most agencies did not have effective information security program functions in fiscal year 2016. GAO and IGs have made hundreds of recommendations to address these security control deficiencies, but many have not yet been fully implemented.
The Office of Management and Budget (OMB), Department of Homeland Security (DHS), National Institute of Standards and Technology (NIST), and IGs have ongoing and planned initiatives to support implementation of the Federal Information Security Management Act of 2002 as amended by the Federal Information Security Modernization Act of 2014 (FISMA) across the federal government. OMB, in consultation with other relevant entities, has expanded the use of a maturity model developed by the Council of the Inspectors General on Integrity and Efficiency and used to evaluate additional information security performance areas each year. However, OMB and others have not developed a plan and schedule to determine whether using the security capability maturity model will provide useful results that are consistent and comparable. Until an evaluative component is incorporated into the implementation of the maturity model, OMB will not have reasonable assurance that agency information security programs have been consistently evaluated.

What GAO Recommends

GAO recommends that OMB, in consultation with DHS and others, develop a plan and schedule to evaluate whether the full implementation of the capability maturity model developed by the Council of the Inspectors General on Integrity and Efficiency ensures that consistent and comparable results are achieved across all federal agencies. OMB generally concurred with our recommendation.