The dramatic expansion in computer interconnectivity and the exponential increase in the use of the Internet are changing the way our government, the nation, and much of the world communicate and conduct business. Operating system controls should limit the extent of information that systems provide to facilitate system interconnectivity. Poor Incident Detection and Response Capabilities Further Impair Security

As our government becomes increasingly dependent on information systems to support sensitive data and mission critical operations, it is essential that agencies protect these resources from misuse and disruption. However, Commerce's information security management program is not effective in any of these key elements. Commerce's information security policies are significantly outdated and incomplete.
Why GAO Did This Study

This testimony discusses information security controls over computer systems at the Department of Commerce.

What GAO Found

Dramatic increases in computer interconnectivity, especially in the use of the Internet, are revolutionizing the way the government, the nation, and much of the world communicate and conduct business. However, this widespread interconnectivity also poses significant risks to the nation's computer systems and to the critical operations and infrastructures they support. This testimony provides information on the effectiveness of Commerce's (1) logical access controls and other information system controls over its computerized data, (2) incident detection and response capabilities, and (3) information security management program and related procedures.