FDIC’s acting CIO is  the corporation’s key official for computer security. Objectives, Scope, and Methodology

The objectives of our review were to assess (1) the progress FDIC had  made in correcting or mitigating weaknesses reported in our calendar year  2001 financial statement audit and (2) the effectiveness of information  system general controls. These information system controls also affect the  security and reliability of other sensitive data, including personnel, legal,  and bank examination information maintained on the same computer  systems as the corporation’s financial information. Of the 41 weaknesses identified in our calendar year  2001 audit, FDIC has corrected 19 and is taking action intended to resolve  the 22 that remain. In addition, new  weaknesses in other information system controls, including physical  security, application software, and service continuity, further increase the  risk to FDIC’s information systems. Computer Security Program Enhanced, but Full Implementation Not Yet Achieved

The primary reason for FDIC’s continuing weaknesses in information  system controls is that it has not yet fully developed and implemented a  comprehensive corporate program to manage computer security. Nonetheless, FDIC’s program does not cover all critical evaluation areas. FDIC has not adequately restricted mainframe access,  sufficiently secured its network, or completed a program for fully  monitoring access activity. Implementation of FDIC’s plan to correct  these weaknesses is essential to establish an effective information system  control environment. While  it has made progress in the past year in establishing key elements of this  program—including a security management structure, security policies and  procedures, and promoting security awareness—its systems will remain at  heightened risk until FDIC establishes a process for assessing and  managing risks on a continuing basis and fully implements a  comprehensive, ongoing program of testing and evaluation to ensure  policies and controls are appropriate and effective.
Why GAO Did This Study

Effective controls over information systems are essential to ensuring the protection of financial and personnel information and the security and reliability of bank examination data maintained bythe Federal Deposit Insurance Corporation (FDIC). As part of GAO's 2002 financial statement audits of the three FDIC funds, we assessed (1) the corporation's progress in addressing computer security weaknesses found in GAO's 2001 audit, and (2) the effectiveness of FDIC's controls.

What GAO Found

FDIC has made progress in correcting information system controls since GAO's 2001 review. Of the 41 weaknesses identified that year, FDIC has corrected or has specific action plans to correct all of them. GAO's 2002 audit nonetheless identified 29 new computer security weaknesses. These weaknesses reduce the effectiveness of FDIC's controls to safeguard critical financial and other sensitive information. Based on our review, mainframe access was not sufficiently restricted, network security was inadequate, and a program to fully monitor access activities was not implemented. Additionally, weaknesses in areas including physical security, application software, and service continuity further increased the risk to FDIC's computing environment. The primary reason for these continuing weaknesses is that FDIC has not yet completed development and implementation of a comprehensive program to manage computer security across the organization. FDIC has, among other things, established a security management structure, but still has not fully implemented a process for assessing and managing risk on a continuing basis or an ongoing program of testing and evaluating controls. The corporation's acting chief information officer has agreed to complete actions intended to address GAO's outstanding recommendations by December 31 of this year.