SEC relies extensively on computerized systems to support its financial  operations and store the sensitive information it collects. SEC Information System Controls Were Not Effective

SEC did not effectively implement information system controls to protect  the integrity, confidentiality, and availability of its financial and sensitive  information. Specifically, the commission did not consistently implement  effective electronic access controls, including user account and passwords,  access rights and permissions, network security, and audit and monitoring  of security-relevant events to prevent, limit, and detect access to its critical  financial and sensitive systems. In addition, weaknesses in other  information system controls, including physical security, segregation of  computer functions, application change controls, and service continuity,  further increase the risk to SEC’s information systems. As a result, sensitive  data—including payroll and financial transactions, personnel data,  regulatory, and other mission critical information—are at increased risk of  unauthorized disclosure, modification, or loss, possibly without being  detected. Comprehensive Information Security Program Is Not Fully Implemented

A key reason for SEC’s weaknesses in information system controls is that it  has not fully developed and implemented a comprehensive agency  information security program to provide reasonable assurance that  effective controls are established and maintained and that information  security receives sufficient management attention. These elements include:  a central information security management structure to provide overall  information security policy and guidance along with oversight to ensure  compliance with established policies and reviews of the effectiveness of  the information security environment;  periodic assessments of the risk and magnitude of the harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;  policies and procedures that (1) are based on risk assessments, (2) cost  effectively reduce risks, (3) ensure that information security is  addressed throughout the life cycle of each system, and (4) ensure  compliance with applicable requirements;  security awareness training to inform personnel, including contractors  and other users of information systems, of information security risks  and their responsibilities in complying with agency policies and  procedures; and  at least annual testing and evaluation of the effectiveness of information  security policies, procedures, and practices relating to management,  operational, and technical controls of every major information system  identified in agencies’ inventories. SEC’s information system control weaknesses were symptomatic of its  weak security program. Nonetheless, the commission has not yet developed clearly defined roles  and responsibilities for this group. Such a program is critical to providing SEC with a solid  foundation for resolving existing information security problems and  continuously managing information security risks. SEC has taken some  action to improve security management, including establishing a central  security management function, appointing a senior information security  officer to manage the program, and initiating actions to correct the specific  weaknesses summarized in this report.
Why GAO Did This Study

The Securities and Exchange Commission (SEC) relies extensively on computerized systems to support its financial and mission-related operations. As part of the audit of SEC's fiscal year 2004 financial statements, GAO assessed the effectiveness of the commission's information system controls in protecting the integrity, confidentiality, and availability of its financial and sensitive information.

What GAO Found

SEC has not effectively implemented information system controls to protect the integrity, confidentiality, and availability of its financial and sensitive data. Specifically, the commission had not consistently implemented effective electronic access controls, including user accounts and passwords, access rights and permissions, network security, or audit and monitoring of security-relevant events to prevent, limit, and detect access to its critical financial and sensitive systems. In addition, weaknesses in other information system controls, including physical security, segregation of computer functions, application change controls, and service continuity, further increase risk to SEC's information systems. As a result, sensitive data--including payroll and financial transactions, personnel data, regulatory, and other mission critical information--were at increased risk of unauthorized disclosure, modification, or loss, possibly without detection. A key reason for SEC's information system control weaknesses is that the commission has not fully developed and implemented a comprehensive agency information security program to provide reasonable assurance that effective controls are established and maintained and that information security receives sufficient management attention. Although SEC has taken some actions to improve security management, including establishing a central security management function and appointing a senior information security officer to manage the program, it had not clearly defined roles and responsibilities for security personnel. In addition SEC had not fully (1) assessed its risks, (2) established or implemented security policies, (3) promoted security awareness, and (4) tested and evaluated the effectiveness of its information system controls. As a result, SEC did not have a solid foundation for resolving existing information system control weaknesses and continuously managing information security risks.