It  requires each agency to develop, document, and implement an  information security program that includes the following components: periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems; policies and procedures that are (1) are based on risk assessments,  (2) cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements;  subordinate plans for providing adequate information security for  networks, facilities, and systems or group of information systems, as  appropriate;  security awareness training to inform personnel, including contractors,  of information security risks and of their responsibilities in complying  with agency policies and procedures designed to reduce these risks,  as well as training personnel with significant security responsibilities  for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of  information systems; a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency. While the six agencies we reviewed generally established security and  privacy requirements for contractors to follow and prepared for  assessments to determine the effectiveness of contractor implementation  of controls, five of the six were inconsistent in overseeing the execution  and review of those assessments. Table 4 details the degree of  implementation of oversight activities for the selected systems at each  agency. Review the assessment results. Further, OMB has developed guidance over several years to assist  agencies in assessing their contractors’ performance. OMB Guidance is Not Clear on When Systems Should Be Identified and Reported as Contractor- Operated

OMB guidance to agencies for categorizing and reporting contractor- operated systems does not clearly define what a contractor-operated  system is and consequently, agencies are interpreting the guidance  differently. Additionally, in their fiscal year 2012 annual FISMA reports, inspectors  general from 9 of the 24 major agencies found data reliability issues with  their agencies’ categorization of contractor-operated systems.example, DOT’s Inspector General reported that 24 of the Department’s  60 information systems were owned and operated by a contractor, but  only 4 were categorized as being contractor-operated by the department. Conclusions

The six agencies reviewed made efforts to assess the implementation of  security and privacy controls for selected contractor-operated systems. A contributing  reason for these shortfalls is that agencies had not documented  procedures for officials to follow in order to perform such oversight of  contractors effectively. Until these agencies develop, document and  implement specific procedures for overseeing contractors, they will have  reduced assurance that the contractors are adequately securing and  protecting agency information, including of the extent to which contractors  have undergone background investigations. Without complete  information, OMB and DHS assistance to agencies for improving their  cybersecurity postures is limited and Congress will not have complete  information on the implementation of FISMA. At that time, we will send copies of this report to the  Administrators of the Environmental Protection Agency and the General  Services Administration, the Directors of the Office of Management and  Budget and the Office of Personnel Management, the Secretaries of  Energy, Homeland Security, State, and Transportation, and other  interested parties. Appendix I: Objectives, Scope, and Methodology

Our objectives were to assess the extent to which (1) selected agencies  oversee the security and privacy controls for systems that are operated  by contractors on their behalf and (2) executive branch agencies with  government wide guidance and oversight responsibilities have taken  steps to assist agencies in ensuring implementation of information  security and privacy controls by contractors.
Why GAO Did This Study

Federal agencies often rely on contractors to operate computer systems and process information on their behalf. Federal law and policy require that agencies ensure that contractors adequately protect these systems and information.
GAO was asked to evaluate how well agencies oversee contractor-operated systems. The objectives of this report were to assess the extent to which (1) selected agencies oversee the security and privacy controls for systems that are operated by contractors on their behalf and (2) executive branch agencies with government-wide guidance and oversight responsibilities have taken steps to assist agencies in ensuring implementation of information security and privacy controls by such contractors. To do this, GAO selected six agencies based on their reported number of contractor-operated systems and two systems at each agency using a non-generalizable random sample for review, analyzed agency policies and procedures, and examined security and privacy-related artifacts for selected systems. GAO also interviewed agency officials, and reviewed federal guidance and evaluated agency FISMA submissions.

What GAO Found

Although the six federal agencies that GAO reviewed (the Departments of Energy (DOE), Homeland Security (DHS), State, and Transportation (DOT), the Environmental Protection Agency (EPA) and the Office of Personnel Management (OPM)) generally established security and privacy requirements and planned for assessments to determine the effectiveness of contractor implementation of controls, five of the six agencies were inconsistent in overseeing the execution and review of those assessments, resulting in security lapses. For example, in one agency, testing did not discover that background checks of contractor employees were not conducted. The following table shows the degree of implementation of oversight activities at selected agencies.
A contributing reason for these shortfalls is that agencies had not documented procedures for officials to follow in order to effectively oversee contractor performance. Until these agencies develop, document, and implement specific procedures for overseeing contractors, they will have reduced assurance that the contractors are adequately securing and protecting agency information.
The Office of Management and Budget (OMB), the National Institute of Standards and Technology, and the General Services Administration have developed guidance to assist agencies in ensuring the implementation of security and privacy controls by their contractors. However, OMB guidance to agencies for categorizing and reporting on contractor-operated systems is not clear on when an agency should identify a system as contractor-operated and therefore agencies are interpreting the guidance differently. In fiscal year 2012, inspectors general from 9 of the 24 major agencies found data reliability issues with agencies' categorization of contractor-operated systems. Without accurate information on the number of contractor-operated systems, OMB assistance to agencies to help improve their cybersecurity posture will be limited and OMB's report to Congress on the implementation of the Federal Information Security Management Act (FISMA) is not complete.

What GAO Recommends

GAO is recommending that five of the six selected agencies develop procedures for the oversight of contractors and that OMB clarify reporting instructions to agencies. The five agencies generally agreed with the recommendations and OMB did not provide any comments.