In this regard,  FISMA requires that agencies implement information security  programs that, among other things, include  ●  periodic assessments of the risk;  ●  risk-based policies and procedures;  ●  subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems,  as appropriate;  ●  security awareness training for agency personnel, including  contractors and other users of information systems that support the  operations and assets of the agency;  ●  periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, performed with a  frequency depending on risk, but no less than annually;  ●  a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies;  ●  procedures for detecting, reporting, and responding to security  ●  plans and procedures to ensure continuity of operations. Agencies Report Progress in Performing Control Activities

Federal agencies continue to report progress in implementing key  information security activities. The President’s proposed fiscal year  2009 budget for IT states that the federal government continues to  improve information security performance relative to the  certification and accreditation of systems and the testing of security  controls and contingency plans. According to the budget, in 2007 the  percentage of certified and accredited systems rose from 88 percent  to 92 percent. Even greater gains were reported in testing of security  controls—from 88 percent of systems to 95 percent of systems—  and for contingency plan testing—from 77 percent to 86 percent. 2). Most agencies did not implement controls to sufficiently prevent,  limit, or detect access to computer networks, systems, or  information. However, agencies did not always configure network devices and  services to prevent unauthorized access and ensure system integrity,  patch key servers and workstations in a timely manner, or segregate  incompatible duties to different individuals or groups so that one  individual does not control all aspects of a process or transaction. Agencywide Security Programs Were Not Fully Implemented

An underlying cause for information security weaknesses identified  at federal agencies is that they have not yet fully or effectively  implemented all the FISMA-required elements for an agencywide  information security program. Consequently, federal systems and information are  at increased risk of unauthorized access to and disclosure,  modification, or destruction of sensitive information, as well as  inadvertent or deliberate disruption of system operations and  services. Opportunities Exist for Enhancing Federal Information Security

In prior reports, GAO and IGs have made hundreds of  recommendations to agencies for actions necessary to resolve prior  significant control deficiencies and information security program  shortfalls. ●  The Information Systems Security Line of Business: The goal of  this initiative is to improve the level of information systems security  across government agencies and reduce costs by sharing common  processes and functions for managing information systems security. Opportunities also exist to enhance policies and practices related to  security control testing and evaluation, FISMA reporting, and the  independent annual evaluations of agency information security  programs required by FISMA. We also previously reported that OMB’s reporting guidance and  performance measures did not include complete reporting on  certain key FISMA-related activities. As a result, OMB and the Congress lack information  that could identify governmentwide issues regarding patch  management. In summary, agencies have reported progress in implementing  control activities, but persistent weaknesses in agency information  security controls threaten the confidentiality, integrity, and  availability of federal information and information systems, as  illustrated by the increasing number of reported security incidents. Opportunities exist to improve information security at federal  agencies. OMB and certain federal agencies have initiated efforts  that are intended to strengthen the protection of federal information  and information systems.
Why GAO Did This Study

Information security is especially important for federal agencies, where the public's trust is essential and poor information security can have devastating consequences. Since 1997, GAO has identified information security as a governmentwide high-risk issue in each of its biennial reports to the Congress. Concerned by reports of significant weaknesses in federal computer systems, Congress passed the Federal Information Security Management Act (FISMA) of 2002, which permanently authorized and strengthened information security program, evaluation, and annual reporting requirements for federal agencies. GAO was asked to testify on the current state of federal information security and compliance with FISMA. This testimony summarizes (1) agency progress in performing key control activities, (2) the effectiveness of information security at federal agencies, and (3) opportunities to strengthen security. In preparing for this testimony, GAO reviewed prior audit reports; examined federal policies, guidance, and budgetary documentation; and analyzed agency and inspector general (IG) reports on information security.

What GAO Found

Over the past several years, federal agencies consistently reported progress in performing certain information security control activities. According to the President's proposed fiscal year 2009 budget for information technology, the federal government continued to improve information security performance in fiscal year 2007 relative to key performance metrics established by the Office of Management and Budget (OMB). The percentage of certified and accredited systems governmentwide reportedly increased from 88 percent to 92 percent. Gains were also reported in testing of security controls - from 88 percent of systems to 95 percent of systems - and for contingency plan testing - from 77 percent to 86 percent. These gains continue a historical trend that GAO reported on last year. Despite reported progress, major federal agencies continue to experience significant information security control deficiencies. Most agencies did not implement controls to sufficiently prevent, limit, or detect access to computer networks, systems, or information. In addition, agencies did not always manage the configuration of network devices to prevent unauthorized access and ensure system integrity, patch key servers and workstations in a timely manner, assign duties to different individuals or groups so that one individual did not control all aspects of a process or transaction, and maintain complete continuity of operations plans for key information systems. An underlying cause for these weaknesses is that agencies have not fully or effectively implemented agencywide information security programs. As a result, federal systems and information are at increased risk of unauthorized access to and disclosure, modification, or destruction of sensitive information, as well as inadvertent or deliberate disruption of system operations and services. Such risks are illustrated, in part, by an increasing number of security incidents experienced by federal agencies. Nevertheless, opportunities exist to bolster federal information security. Federal agencies could implement the hundreds of recommendations made by GAO and IGs to resolve prior significant control deficiencies and information security program shortfalls. In addition, OMB and other federal agencies have initiated several governmentwide initiatives that are intended to improve security over federal systems and information. For example, OMB has established an information systems security line of business to share common processes and functions for managing information systems security and directed agencies to adopt the security configurations developed by the National Institute of Standards and Technology and Departments of Defense and Homeland Security for certain Windows operating systems. Opportunities also exist to enhance policies and practices related to security control testing and evaluation, FISMA reporting, and the independent annual evaluations of agency information security programs required by FISMA.