3844 proposes a number of changes and clarifications that we believe  could strengthen information security requirements, some of which  address issues noted in the first-year implementation of GISRA. 3844 includes a number of provisions that  would require the development, promulgation, and compliance with  minimum mandatory management controls for securing information and  information systems to manage risks as determined by agencies. In  particular, it requires agencies to submit an annual report to both OMB  and the comptroller general. 3844’s more significant changes to  NIST’s role and responsibilities would require NIST to: develop mandatory minimum information security requirements and  guidance for detecting and handling of information security incidents and  for identifying an information system as a national security system; establish a NIST Office for Information Security Programs to be headed by  a senior executive level director; and    report annually to OMB to create a more active role for NIST in  governmentwide information security oversight and to help ensure that  OMB receives regular updates on the state of federal information security. As I emphasized in my March 2002 testimony, as the administration refines  the strategy that it has begun to lay out in recent months, it is imperative  that it take steps to ensure that information security receives appropriate  attention and resources and that known deficiencies are addressed. These steps would include the following:  It is important that the federal strategy delineate the roles and  responsibilities of the numerous entities involved in federal information  security and related aspects of critical infrastructure protection. Agencies must have the technical expertise they need to select, implement,  and maintain controls that protect their information systems.
What GAO Found

The Federal Information Security Management Act of 2002 reauthorizes and expands the information security, evaluation, and reporting requirements enacted in the National Defense Authorization Act for Fiscal Year 2001. Concerned that pervasive information security weaknesses place federal operations at significant risk of disruption, tampering, fraud, and inappropriate disclosures of sensitive information, Congress enacted the Government Security Reform Act (GISRA) for more effective oversight. The Federal Information Security Management Act also changes and clarifies information security issues noted in the first-year implementation of GISRA. In particular, the bill requires the development, promulgation of, and compliance with minimum mandatory management controls for securing information and information systems; requires annual agency reporting to both the Office of Management and Budget and the Comptroller General; and defines the evaluation responsibilities for national security systems. To ensure that information security receives appropriate attention and resources and that known deficiencies are addressed, it will be necessary to delineate the roles and responsibilities of the numerous entities involved; obtain adequate technical expertise to select, implement, and maintain controls; and allocate enough agency resources for information security.