Specifically, FISMA requires information security programs to include,  among other things:    periodic assessments of the risk and magnitude of harm that could result  from the unauthorized access, use, disclosure, disruption, modification, or  destruction of information or information systems; risk-based policies and procedures that cost-effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system;   subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems, as  appropriate;   security awareness training for agency personnel, including contractors  and other users of information systems that support the operations and  assets of the agency;   periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, performed with a frequency depending  on risk, but no less than annually, and that includes testing of  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information systems;   a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in the information security  policies, procedures, and practices of the agency;   procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. Weaknesses in Information Security Place Sensitive Information at Risk

Significant weaknesses in information security policies and practices  threaten the confidentiality, integrity, and availability of critical  information and information systems used to support the operations,  assets, and personnel of most federal agencies. These persistent  weaknesses expose sensitive data to significant risk, as illustrated by  recent incidents at various agencies. At least 23 major federal agencies had access control weaknesses during  fiscal year 2008. Agencies have not fully implemented their risk assessment processes. As a result, agencies have reduced assurance that their  systems and the information they contain are sufficiently protected. Opportunities Exist for Bolstering Federal Information Security

In prior reports, we and inspectors general have made hundreds of  recommendations to agencies for actions necessary to resolve prior  significant control deficiencies and information security program  shortfalls. Agencies Continue to Report Progress in Implementing Requirements

Federal agencies reported increased compliance in implementing key  information security control activities for fiscal year 2008; however,  inspectors general at several agencies noted shortcomings with agencies’  implementation of information security requirements. Consistent with previous years, inspectors general continued to identify  weaknesses with the processes and practices agencies have in place to  implement FISMA requirements. Although OMB took steps to clarify its  reporting instructions to agencies for preparing fiscal year 2008 reports,  the instructions did not request inspectors general to report on agencies’  effectiveness of key activities and did not always provide clear guidance to  inspectors general. In  addition, agencies are required to provide appropriate training on  information security to personnel who have significant security  responsibilities. Appendix I: Objectives, Scope, and Methodology

In accordance with the Federal Information Security Management Act of  2002 (FISMA) requirement that the Comptroller General report  periodically to Congress, our objectives were to evaluate (1) the adequacy  and effectiveness of agencies’ information security policies and practices  and (2) federal agency implementation of FISMA requirements.
Why GAO Did This Study

For many years, GAO has reported that weaknesses in information security are a widespread problem that can have serious consequences--such as intrusions by malicious users, compromised networks, and the theft of intellectual property and personally identifiable information--and has identified information security as a governmentwide high-risk issue since 1997. Concerned by reports of significant vulnerabilities in federal computer systems, Congress passed the Federal Information Security Management Act of 2002 (FISMA), which authorized and strengthened information security program, evaluation, and reporting requirements for federal agencies. In accordance with the FISMA requirement that the Comptroller General report periodically to Congress, GAO's objectives were to evaluate (1) the adequacy and effectiveness of agencies' information security policies and practices and (2) federal agencies' implementation of FISMA requirements. To address these objectives, GAO analyzed agency, inspectors general, Office of Management and Budget (OMB), and GAO reports.

What GAO Found

Persistent weaknesses in information security policies and practices continue to threaten the confidentiality, integrity, and availability of critical information and information systems used to support the operations, assets, and personnel of most federal agencies. Recently reported incidents at federal agencies have placed sensitive data at risk, including the theft, loss, or improper disclosure of personally identifiable information of Americans, thereby exposing them to loss of privacy and identity theft. For fiscal year 2008, almost all 24 major federal agencies had weaknesses in information security controls. An underlying reason for these weaknesses is that agencies have not fully implemented their information security programs. As a result, agencies have limited assurance that controls are in place and operating as intended to protect their information resources, thereby leaving them vulnerable to attack or compromise. In prior reports, GAO has made hundreds of recommendations to agencies for actions necessary to resolve prior significant control deficiencies and information security program shortfalls. Federal agencies reported increased compliance in implementing key information security control activities for fiscal year 2008; however, inspectors general at several agencies noted shortcomings with agencies' implementation of information security requirements. Agencies reported increased implementation of control activities, such as providing awareness training for employees and testing system contingency plans. However, agencies reported decreased levels of testing security controls and training for employees who have significant security responsibilities. In addition, inspectors general at several agencies disagreed with performance reported by their agencies and identified weaknesses in the processes used to implement these activities. Further, although OMB took steps to clarify its reporting instructions to agencies for preparing fiscal year 2008 reports, the instructions did not request inspectors general to report on agencies' effectiveness of key activities and did not always provide clear guidance to inspectors general. As a result, the reporting may not adequately reflect agencies' implementation of the required information security policies and procedures.