Federal Laws and Guidance Provide a Foundation for Agencies to Protect Personally Identifiable Information

The primary laws that provide privacy protections to personal information  are the Privacy Act of 1974 and the E-Government Act of 2002; these laws  describe, among other things, agency responsibilities with regard to  personally identifiable information, which include providing security. The  security of information held by the federal government is specifically  addressed by FISMA, which requires agencies to develop, document, and  implement agencywide programs to provide security for their information  and information systems, including personally identifiable information. In the wake  of recent incidents of security breaches involving personal data, OMB has  issued guidance reiterating the requirements of these laws and guidance,  drawing particular attention to those associated with personally  identifiable information. Specifically, the act requires that these information security programs  include, among other things,    periodic assessments of the risk and magnitude of harm that could result  from the unauthorized access, use, disclosure, disruption, modification, or  destruction of information or information systems; risk-based policies and procedures that cost-effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system;   subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems, as  appropriate;   security awareness training for agency personnel, including contractors  and other users of information systems that support the operations and  assets of the agency;   periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, performed with a frequency depending  on risk, but no less than annually, and that includes testing of  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information systems;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency;    procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. FIPS 200, Minimum Security Requirements for Federal Information and  Information Systems. In recent guidance, OMB directed agencies to encrypt and  otherwise protect personally identifiable information that is either  accessed remotely or physically transported outside an agency’s secured  physical perimeter. Specifically, agencies were required to    encrypt all data on mobile computers or devices that carry agency data,  unless the data are determined to be nonsensitive;   allow remote access only with two-factor authentication, where one of the  factors is provided by a device separate from the computer gaining access;   use a “time-out” function for remote access and mobile devices that  requires that users re-authenticate after 30 minutes of inactivity; and log all instances in which computer-readable data are extracted from  databases holding sensitive information, and verify that each extract  including sensitive data has been erased within 90 days or that its use is  still required. However, not all agencies had developed policies and procedures  reflecting OMB guidance for protecting personally identifiable information  that is accessed remotely or physically transported outside an agency’s  secured perimeter. Of the 24 major agencies, 22 had developed policies  requiring personally identifiable information to be encrypted on mobile  computers and devices. Fewer agencies (11) had established policies to log  computer-readable data extracts from databases holding sensitive  information and erase the data within 90 days after extraction. However,  several of the agencies that had not established such policies indicated  that they were researching technical solutions to address these issues. Gaps in their policies and procedures reduce agencies’ ability to protect  personally identifiable information from improper disclosure. The loss of  personally identifiable information can result in substantial harm,  embarrassment, and inconvenience to individuals and may lead to identity  theft or other fraudulent use of the information. According to OMB, it will  continue working with agencies to help them strengthen their information  security and privacy programs, especially as they relate to the protection  of personally identifiable information. In view of OMB’s recent actions in  this area, we are making no recommendations at this time. Agencies’ implementation of OMB’s guidance  on personally identifiable information, as well as our previous  recommendations on improving agency information security and  implementation of FISMA requirements, will be essential in improving the  protection of personally identifiable information. Agency Comments

In providing oral comments on a draft of this report, OMB representatives  stated that they generally agreed with the report’s contents. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) identify the federal laws and guidance issued to  protect personally identifiable information from unauthorized use or  disclosure and (2) describe agencies’ policies and documented procedures  that respond to recent Office of Management and Budget (OMB) guidance  to protect personally identifiable information that is either accessed  remotely or physically transported outside an agency’s secured physical  perimeter.
Why GAO Did This Study

The loss of personally identifiable information can result in substantial harm, embarrassment, and inconvenience to individuals and may lead to identity theft or other fraudulent use of the information. As shown in prior GAO reports, compromises to such information and long-standing weaknesses in federal information security raise important questions about what steps federal agencies should take to prevent them. As the federal government obtains and processes information about individuals in increasingly diverse ways, properly protecting this information and respecting the privacy rights of individuals will remain critically important. GAO was requested to (1) identify the federal laws and guidance issued to protect personally identifiable information from unauthorized use or disclosure and (2) describe agencies' progress in developing policies and documented procedures that respond to recent guidance from the Office of Management and Budget (OMB) to protect personally identifiable information that is either accessed remotely or physically transported outside an agency's secured physical perimeter. To do so, GAO reviewed relevant laws and guidance, surveyed officials at 24 major federal agencies, and examined and analyzed agency documents, including policies, procedures, and plans. In commenting on a draft of this report, OMB stated that it generally agreed with the report's contents.

What GAO Found

Two primary laws (the Privacy Act of 1974 and the E-Government Act of 2002) give federal agencies responsibilities for protecting personal information, including ensuring its security. Additionally, the Federal Information Security Management Act of 2002 (FISMA) requires agencies to develop, document, and implement agencywide programs to provide security for their information and information systems (which include personally identifiable information and the systems on which it resides). The act also requires the National Institute of Standards and Technology (NIST) to develop technical guidance in specific areas, including minimum information security requirements for information and information systems. In the wake of recent incidents of security breaches involving personal data, OMB issued guidance in 2006 and 2007 reiterating agency responsibilities under these laws and technical guidance, drawing particular attention to the requirements associated with personally identifiable information. In this guidance, OMB directed, among other things, that agencies encrypt data on mobile computers or devices and follow NIST security guidelines regarding personally identifiable information that is accessed outside an agency's physical perimeter. Not all agencies had developed the range of policies and procedures reflecting OMB guidance on protection of personally identifiable information that is either accessed remotely or physically transported outside an agency's secured physical perimeter. Of 24 major agencies, 22 had developed policies requiring personally identifiable information to be encrypted on mobile computers and devices. Fifteen of the 24 agencies had policies to use a "time-out" function for remote access and mobile devices requiring user reauthentication after 30 minutes of inactivity. Fewer agencies (11) had established policies to log computer-readable data extracts from databases holding sensitive information and erase the data within 90 days after extraction. Several agencies indicated that they were researching technical solutions to address these issues. Gaps in their policies and procedures reduced agencies' ability to protect personally identifiable information from improper disclosure. At the conclusion of GAO's review, OMB announced in November 2007 that agencies that did not complete certain privacy and security requirements, including those just described, received a downgrade in their scores for progress in electronic government initiatives. According to OMB, it will continue working with agencies to help them strengthen their information security and privacy programs, especially as they relate to the protection of personally identifiable information. In view of OMB's recent actions in this area and GAO's previous recommendations on improving agency information security and implementation of FISMA requirements, GAO is making no further recommendations at this time.