Specifically, this program is to include    periodic assessments of the risk and magnitude of harm that could result  from the unauthorized access, use, disclosure, disruption, modification, or  destruction of information or information systems; risk-based policies and procedures that cost-effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system;   periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices that include testing of management,  operational, and technical controls for every system identified in the  agency’s required inventory of major information systems;    subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems;   security awareness training for agency personnel, including contractors  and other users of information systems that support the operations and  assets of the agency;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency;    procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. The processes and criteria established by this guidance are  often similar to those required by NIST guidance for non-national security  systems. Progress Is Being Made to Harmonize IT Security Guidance

A task force consisting of representatives from civilian, defense, and  intelligence agencies has made progress in establishing a unified  information security framework for national security and non-national  security systems. Specifically, NIST has published three initial documents  developed by a task force working group to harmonize information  security standards for national security and non-national security systems,  and is scheduled to publish two more by early 2011. While much has been  accomplished, differences remain between the guidance for the two types  of systems, and significant work remains to implement the harmonized  guidance on national security systems, such as developing supporting  agency-specific guidance and establishing specific time frames and  performance measures for implementation. According to officials  involved in the task force, harmonized security guidance is expected to  result in less duplication of effort, lower maintenance costs, and more  effective implementation of controls across multiple interconnected  systems. These include differences in system categorization,  selection of security controls, and use of program management controls. Additional Supporting Guidance Is Being Developed for National Security Systems, but Detailed Time Frames for Implementation Have Not Been Established

While much of the harmonized guidance is already in use for non-national  security systems, significant work remains to implement the new guidance  on national security systems. Once DOD issues guidance for implementing the joint task force’s  harmonized guidance, officials said that it will take several more years to  incorporate the security controls into the systems’ security plans. The task force has  proposed two additional publications for consideration and acknowledged  the possibility of future areas for collaboration, but plans for additional  activities have yet to be finalized. We also recommend that the Secretary of Defense direct CNSS to    collaborate with NIST to complete plans to identify future areas for  harmonization efforts;   collaborate with its member organizations, including both DOD and the  intelligence community, to include milestones and performance measures  in their plans to implement the harmonized CNSS policies and guidance;  and   collaborate with NIST to consider how implementing elements of key  collaborative practices, such as documenting roles and responsibilities,  needs, resources, and monitoring and reporting mechanisms, may serve to  sustain and enhance the harmonization effort. Agency Comments and Our Evaluation

In written comments on a draft of this report, the Secretary of Commerce  concurred with our conclusions that the Departments of Commerce and  Defense update plans for future collaboration, establish timelines for  implementing revised guidance, and fully implement key practices for  interagency collaboration in the harmonization effort. Appendix I: Objective, Scope, and Methodology

The objective of our review was to assess the progress of federal efforts to  harmonize policies and guidance for national security systems and non- national security systems. To do this, we reviewed program plans, schedules, and performance  measures related to the harmonization efforts. We also obtained and  reviewed current information technology security policies, guidance, and  other documentation for national security systems and non-national  security systems and then conducted interviews with officials from the  National Institute of Standards and Technology (NIST), Committee on  National Security Systems (CNSS), Department of Defense (DOD), Office  of the Director of National Intelligence (ODNI), National Security Agency  (NSA), and Office of Management and Budget (OMB) to identify  differences in existing guidance and plans to resolve these differences.
Why GAO Did This Study

Historically, civilian and national security-related information technology (IT) systems have been governed by different information security policies and guidance. Specifically, the Office of Management and Budget and the Department of Commerce's National Institute of Standards and Technology (NIST) established policies and guidance for civilian non-national security systems, while other organizations, including the Committee on National Security Systems (CNSS), the Department of Defense (DOD), and the U.S. intelligence community, have developed policies and guidance for national security systems. GAO was asked to assess the progress of federal efforts to harmonize policies and guidance for these two types of systems. To do this, GAO reviewed program plans and schedules, analyzed policies and guidance, assessed program efforts against key practices for cross-agency collaboration, and interviewed officials responsible for this effort.

What GAO Found

Federal agencies have made progress in harmonizing information security policies and guidance for national security and non-national security systems. Representatives from civilian, defense, and intelligence agencies established a joint task force in 2009, led by NIST and including senior leadership and subject matter experts from participating agencies, to publish common guidance for information systems security for national security and non-national security systems. The harmonized guidance is to consist of NIST guidance applicable to non-national security systems and authorized by CNSS, with possible modifications, for application to national security systems. This harmonized security guidance is expected to result in less duplication of effort and more effective implementation of controls across multiple interconnected systems. The task force has developed three initial publications. These publications, among other things, provide guidance for applying a risk management framework to federal systems, identify an updated catalog of security controls and guidelines, and update the existing security assessment guidelines for federal systems. CNSS has issued an instruction to begin implementing the newly developed guidance for national security systems. Two additional joint publications are scheduled for release by early 2011, with other publications under consideration. Differences remain between guidance for national security and non-national security systems in such areas as system categorization, selection of security controls, and program management controls. NIST and CNSS officials stated that these differences may be addressed in the future but that some may remain because of the special nature of national security systems. While progress has been made in developing the harmonized guidance, additional work remains to implement it and ensure continued progress. For example, task force members have stated their intent to develop plans for future harmonization activities, but these plans have not yet been finalized. In addition, while much of the harmonized guidance incorporates controls and language previously developed for use for non-national security systems, significant work remains to implement the guidance for national security systems. DOD and the intelligence community are developing agency-specific guidance and transition plans for implementing the harmonized guidance, but, according to officials, actual implementation could take several years to complete. Officials stated that this is primarily due to both the large number and criticality of the systems that must be reauthorized under the new guidance. Further, the agencies have yet to fully establish implementation milestones and lack performance metrics for measuring progress. Finally, the harmonization effort has been managed without full implementation of key collaborative practices, such as documenting identified needs and leveraging resources to address those needs, agreed-to agency roles and responsibilities, and processes to monitor and report results. Task force members stress that their informal, flexible approach has resulted in significant success. Nevertheless, further implementation of key collaborative practices identified by GAO could facilitate further progress.

What GAO Recommends

GAO is recommending that the Secretary of Commerce and the Secretary of Defense, among other things, update plans for future collaboration, establish timelines for implementing revised guidance, and fully implement key practices for interagency collaboration in the harmonization effort. In comments on a draft of this report, Commerce and DOD concurred with GAO's recommendations.