FISMA 2002 required each agency in the executive branch to develop,  document, and implement an information security program that includes  the following components: periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems; policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements;  subordinate plans for providing adequate information security for  networks, facilities, and systems or a group of information systems, as  appropriate;  security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies  and procedures, as well as training personnel with significant security  responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems; a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security  incidents; and plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency. Expands exemptions from OMB oversight for certain national security- related systems. In addition, FISMA 2014 reiterates the previous requirement for federal  agencies to develop, document, and implement an agency-wide  information security program. Accordingly, we and agency inspectors  general have made hundreds of recommendations to agencies to address  these security control deficiencies. In one example, an  agency had not fully developed and implemented components of its  agency-wide information security risk management program that met  FISMA’s requirements. However, many agencies continue to have weaknesses in implementing  these controls in part because many of these recommendations remain  unimplemented. However, work by the inspectors general revealed weaknesses in risk  management. According to OMB, inspectors general at seven agencies  reported that their agency did not have a risk management program in  place. The agencies generally concurred with our  recommendations. Guidance for Reporting Agency Evaluations Was Not always Complete

FISMA 2002 specified that OMB, among its other responsibilities, is to  develop policies, principles, standards, and guidelines on information  security and report to Congress. Each year, OMB and DHS provide  guidance to federal agencies and their inspectors general for preparing  their FISMA reports and then summarize the information provided by the  agencies and the inspectors general in OMB’s annual report to Congress. Federal agencies’ implementation of FISMA during fiscal years 2013 and  2014 was mixed. Recommendation for Executive Action

We recommend that the Director of the Office of Management and  Budget, in consultation with the Secretary of Homeland Security, the  Chief Information Officers Council, and the Council of the Inspectors  General on Integrity and Efficiency, enhance reporting guidance to the  inspectors general for all rating components of agency security programs,  such as configuration management and risk management, so that the  ratings will be consistent and comparable. Key contributors to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to evaluate (1) the adequacy and effectiveness of  federal agencies’ information security policies and procedures and (2) the  extent to which federal agencies have implemented the requirements of  the Federal Information Security Management Act (FISMA) of 2002.
Why GAO Did This Study

Since 1997, GAO has designated federal information security as a government-wide high risk area, and in 2003 expanded this area to include computerized systems supporting the nation's critical infrastructure. In February 2015, in its high risk update, GAO further expanded this area to include protecting the privacy of personal information that is collected, maintained, and shared by both federal and nonfederal entities.
FISMA required federal agencies to develop, document, and implement an agency-wide information security program. The act also assigned OMB with overseeing agencies' implementation of security requirements.
FISMA also included a provision for GAO to periodically report to Congress on (1) the adequacy and effectiveness of agencies' information security policies and practices and (2) agencies' implementation of FISMA requirements. GAO analyzed information security-related reports and data from 24 federal agencies, their inspectors general, and OMB; reviewed prior GAO work; examined documents from OMB and DHS; and spoke to agency officials.

What GAO Found

Persistent weaknesses at 24 federal agencies illustrate the challenges they face in effectively applying information security policies and practices. Most agencies continue to have weaknesses in (1) limiting, preventing, and detecting inappropriate access to computer resources; (2) managing the configuration of software and hardware; (3) segregating duties to ensure that a single individual does not have control over all key aspects of a computer-related operation; (4) planning for continuity of operations in the event of a disaster or disruption; and (5) implementing agency-wide security management programs that are critical to identifying control deficiencies, resolving problems, and managing risks on an ongoing basis (see fig.). These deficiencies place critical information and information systems used to support the operations, assets, and personnel of federal agencies at risk, and can impair agencies' efforts to fully implement effective information security programs. In prior reports, GAO and inspectors general have made hundreds of recommendations to agencies to address deficiencies in their information security controls and weaknesses in their programs, but many of these recommendations remain unimplemented.
Federal agencies' implementation in fiscal years 2013 and 2014 of requirements set by the Federal Information Security Management Act of 2002 (FISMA) was mixed. For example, most agencies had developed and documented policies and procedures for managing risk, providing security training, and taking remedial actions, among other things. However, each agency's inspector general reported weaknesses in the processes used to implement FISMA requirements. In addition, to comply with FISMA's annual reporting requirements, the Office of Management and Budget (OMB) and the Department of Homeland Security (DHS) provide guidance to the inspectors general on conducting and reporting agency evaluations. Nevertheless, GAO found that this guidance was not always complete, leading to inconsistent application by the inspectors general. For example, because it did not include criteria for making overall assessments, inspectors general inconsistently reported agency security performance.

What GAO Recommends

GAO is recommending that OMB, in consultation with DHS and others, enhance security program reporting guidance to inspectors general so that the ratings of agency security performance will be consistent and comparable. OMB generally concurred with our recommendation.