Objectives, Scope, and Methodology

Our objectives were to (1) provide a general overview of the adequacy of federal information security at major federal agencies based on reported information, (2) identify and categorize the most significant information security weaknesses reported, (3) identify the general causes of reported weaknesses, and (4) assess OMB’s efforts to oversee agency information security practices. Audits and Self Assessments Have Identified Serious Weaknesses That Increase Risks

Recent audits show that weak information security is a serious governmentwide problem that is putting major federal operations at risk. Of the 10 agencies with reported weaknesses, FMFIA reports for 5 showed that the problems had remained uncorrected for 5 years or longer. However, in our reviews of information security controls, we found that the major underlying factor was lack of a well managed information security program with senior management support. However, the documented information that OMB routinely obtains on the design and effectiveness of agency information security programs varies significantly in quality, quantity, and usefulness. Further, the reporting formats varied considerably among agencies. Another is the recently established CIO Council, which can serve as a forum for addressing governmentwide information security issues and raising security awareness. Initiatives that the CIO Council should consider incorporating in its strategic plan include developing information on the existing security risks associated with nonclassified systems currently in use; developing information on the risks associated with evolving practices, such as Internet use; identifying best practices regarding information security programs so that they can be adopted by federal agencies; establishing a program for reviewing the adequacy of individual agency information security programs using interagency teams of reviewers; ensuring adequate review coverage of agency information security practices by considering the scope of various types of audits and reviews performed and acting to address any identified gaps in coverage; developing or identifying training and certification programs that can be shared among agencies; and identifying proven security tools and techniques.
Why GAO Did This Study

Pursuant to a congressional request, GAO provided a general overview of the adequacy of information security at 15 major federal agencies, focusing on: (1) recent reviews and self-audits of information security at these agencies; (2) the most significant information security weaknesses and their causes; and (3) the Office of Management and Budget's (OMB) oversight of federal agency practices and opportunities for improvement.

What GAO Found

GAO found that: (1) recent audits and reviews indicate that weak information security is a serious governmentwide problem, with serious weaknesses reported for over two-thirds of the agencies reviewed; (2) commonly reported weaknesses include information access control problems and inadequate disaster planning; (3) at half of the agencies reviewed, information security problems remained uncorrected for 5 years or longer; (4) many agencies lack a well-managed information security program with senior management support; (5) although OMB has improved federal information security guidance and its monitoring of agency efforts to address identified weaknesses, the scope and depth of its oversight efforts varies considerably among agencies; (6) information that OMB obtains on federal information security programs varies significantly in terms of the quality, quantity, and usefulness of the information; (7) OMB could use expanded requirements under the Chief Financial Officers Act to further monitor agencies' information security programs and weaknesses; and (8) the recently established Chief Information Officers (CIO) Council can serve as a forum for addressing governmentwide information security issues.