As a result of these analyses, we have identified information security as a governmentwide high- risk issue in reports to the Congress since 1997—most recently in January 2001. Our most recent analyses, of reports published from July 2000 through September 2001, continue to show significant weaknesses in federal computer systems that put critical operations and assets at risk.Weaknesses continued to be reported in each of the 24 agencies included in our review, and they covered all six major areas of general controls—the policies, procedures, and technical controls that apply to all or a large segment of an entity’s information systems and help ensure their proper operation. Nevertheless, the results leave no doubt that serious, pervasive weaknesses persist. Audit coverage for nonfinancial systems is also likely to increase as agencies review and evaluate their information security programs as required by government information security reform provisions. Success in achieving these benefits will require agencies and others involved to ensure that the systems supporting E-government are protected from fraud, inappropriate disclosures, and disruption. Accordingly, it is important that federal information security efforts be guided by a comprehensive strategy for improvement.
What GAO Found

Federal agencies rely extensively on computer systems and electronic data to support their missions. The security of these systems is essential to avoiding disruptions in critical operations and to prevent data tampering, fraud, and inappropriate disclosure of sensitive information. GAO analyzed information security audits and evaluations at 24 major federal departments and agencies since July 2000. This testimony summarizes (1) the pervasive weaknesses that led GAO to begin reporting information security as a government-wide high-risk issue in 1997, (2) the serious risks that these weaknesses pose at selected agencies and common weaknesses that agencies need to address to improve their information security programs, and (3) the importance of establishing strong agency-wide security management programs and developing a comprehensive government-wide strategy for improvement.