	Background

OPM collects and maintains personal information on millions of  individuals, including sensitive security clearance data. OPM Has Made Progress in Improving Its Security to Prevent, Mitigate, and Respond to Breaches, but Efforts Are Not Complete

Since the 2015 data breaches, OPM has made progress in improving its  security to prevent, mitigate, and respond to data breaches involving  sensitive personal records and background investigations information. For the remaining 8 recommendations, actions for 4 were still in progress. In addition, OPM’s policy requires that scheduled  completion dates be included in the plan. OPM Made Progress Addressing Policies and Practices Associated with Key Government-wide Initiatives and Requirements, but Had Not Fully Implemented All of Them

OMB’s CSIP and CAP Goals require federal agencies, including OPM, to  take specific cybersecurity actions to bolster their system security. Until OPM completes implementation of the  government-wide requirements, its systems are at greater risk than they  need be. OPM had developed, documented, and implemented an information  security policy for identifying its high value assets. Due to the sensitive nature of the recommendation and  the actions needed to implement it, these details are provided in a  separate report with limited distribution. For example, OPM’s information security  handbook states that signatures related to malware should be updated. However, OPM did not consistently assess the security controls at  defined frequencies for the three selected systems we reviewed. OPM’s Procedures for Overseeing the Security of its Contractor-Operated Systems Did Not Ensure that Controls Were Comprehensively Tested

OPM has implemented elements of contractor oversight such as  recording security assessment findings for contractor-operated systems in  remediation plans, but it did not ensure that system security assessments  involved comprehensive testing. The agency requires ISSOs to conduct  quality assurance reviews that include reviewing security assessments of  contractor-operated systems; however, its policy did not include detailed  guidance on how the reviews are to be conducted. Therefore, the agency will have less assurance that the  security controls for its contractor-operated systems are comprehensively  assessed. The agency did not concur with our recommendation. Therefore, we believe the recommendation is warranted. In a separate report with limited distribution, we are making nine  recommendations to the Acting Director to improve upon actions taken to  implement the recommendations made by US-CERT and to further  implement government-wide requirements. Effective implementation of these actions and our  recommendations is essential to ensuring that sufficient security controls  are in place and operating as intended. Appendix I: Objectives, Scope, and Methodology

Our objectives were to evaluate the Office of Personnel Management’s  (OPM) 1) actions since the 2015 data breaches to prevent, mitigate, and  respond to data breaches involving sensitive personnel records and  information; 2) information security policies and practices as they relate to  selected government-wide initiatives and requirements; and 3)  procedures for overseeing the security of OPM information maintained by  contractors providing information technology services. To address the first objective, we assessed the extent to which the  agency had implemented 19 recommendations that the United States  Computer Emergency Response Team (US-CERT) made in its 2015  breach investigation report. We interviewed officials from  OPM’s Office of the Chief Information Officer (OCIO) and reviewed the  agency’s information security documentation, to include policies, plans,  and procedures.
Why GAO Did This Study

OPM collects and maintains personal data on millions of individuals, including data related to security clearance investigations. In 2015, OPM reported significant breaches of personal information that affected 21.5 million individuals.
The Senate report accompanying the Financial Services and General Government Appropriations Act, 2016 included a provision for GAO to review information security at OPM. GAO evaluated OPM's (1) actions since the 2015 reported data breaches to prevent, mitigate, and respond to data breaches involving sensitive personnel records and information; (2) information security policies and practices for implementing selected government-wide initiatives and requirements; and (3) procedures for overseeing the security of OPM information maintained by contractors providing IT services. To do so, GAO examined policies, plans, and procedures and other documents; tested controls for selected systems; and interviewed officials. This is a public version of a sensitive report being issued concurrently. GAO omitted certain specific examples due to the sensitive nature of the information.

What GAO Found

Since the 2015 data breaches, the Office of Personnel Management (OPM) has taken actions to prevent, mitigate, and respond to data breaches involving sensitive personal and background investigation information, but actions are not complete. OPM implemented or made progress towards implementing 19 recommendations made by the United States Computer Emergency Readiness Team (US-CERT) to bolster OPM's information security practices and controls in the wake of the 2015 breaches. GAO determined that the agency completed actions for 11 of the recommendations and took actions for the remaining 8, with actions for 4 of these 8 requiring further improvement (see table). In addition, OPM did not consistently update completion dates for outstanding recommendations and did not validate corrective actions taken to ensure that the actions effectively addressed the recommendations.
OPM also made progress in implementing information security policies and practices associated with selected government-wide initiatives and requirements. However, it did not fully implement all of the requirements. For example, OPM identified its high value assets, such as systems containing sensitive information that might be attractive to potential adversaries, but it did not encrypt stored data on one selected system and did not encrypt transmitted data on another. Until OPM completes implementation of government-wide requirements, its systems are at greater risk than they need be.
OPM's procedures for overseeing the security of its contractor-operated systems did not ensure that controls were comprehensively tested. Although the agency has implemented elements of contractor oversight such as recording security assessment findings for contractor-operated systems in remediation plans, it did not ensure that system security assessments involved comprehensive testing. The agency requires information system security officers to conduct quality assurance reviews that include reviewing security assessments of contractor-operated systems; however, its policy did not include detailed guidance on how the reviews are to be conducted. Until such a procedure is clearly defined and documented, OPM will have less assurance that the security controls intended to protect OPM information maintained on contractor-operated systems are sufficiently implemented.

What GAO Recommends

GAO is making five recommendations to improve OPM's security. OPM concurred with four of these and partially concurred with the one on validating its corrective actions. GAO continues to believe that implementation of this recommendation is warranted. In GAO's limited distribution report, GAO made nine additional recommendations.