However, 4  years into the implementation of FISMA, many agencies continue to  exhibit weaknesses in carrying out the act’s requirements. The reasons that the departments are challenged in these areas vary. Until the departments address these challenges and  fully implement an effective departmentwide information security  program, they increase the risk that they may not effectively protect the  confidentiality, integrity, and availability of their information and  information systems. Of the four departments, Homeland Security and Justice reported having  complete system inventories. In addition, the  department reported that it was unable to accurately report on the  percentage of employees who have received specialized training because  its reporting tool counts each course taken, instead of tracking that an  individual has taken a specialized course. As a result, it could not be  assured that all users had completed required training. Departments Have Weaknesses in the Testing and Evaluation of Their Information Security Programs

FISMA requires that department information security programs include  periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices. As a result, the department is challenged in  accurately tracking information security weaknesses. Conclusions

Defense, Homeland Security, Justice, and State face challenges in  implementing key information security control activities required by  FISMA and OMB, which include maintaining complete and accurate  system inventories, implementing common security configurations for all  system platforms, training personnel, establishing and consistently  implementing complete policies and processes for testing security  controls, and fully certifying and accrediting information systems. Appendix I: Objective, Scope, and Methodology

Our objective was to determine the challenges or obstacles that inhibit the  implementation of the information security provisions of the Federal  Information Security Management Act of 2002 (FISMA) at the  Departments of Defense, Homeland Security, Justice, and State. To do this, we reviewed and analyzed FISMA (Public Law 107-347) and  mapped these requirements to (1) National Institute of Standards and  Technology (NIST) guidelines and (2) Office of Management and Budget  (OMB) reporting requirements.
Why GAO Did This Study

The Federal Information Security Management Act of 2002 (FISMA) strengthened security requirements by, among other things, requiring federal agencies to establish programs to provide cost-effective security for information and information systems. In overseeing FISMA implementation, the Office of Management and Budget (OMB) has established supporting processes and reporting requirements. However, 4 years into implementation of the act, agencies have not yet fully implemented key provisions. In this context, GAO determined what challenges or obstacles inhibit the implementation of the information security provisions of FISMA at the Departments of Defense, Homeland Security, Justice, and State. To do this, GAO reviewed and analyzed department policies, procedures, and reports related to department information security programs and interviewed agency officials.

What GAO Found

Defense, Homeland Security, Justice, and State face challenges in implementing key information security control activities required by FISMA and by OMB in its oversight role. These activities include creating and maintaining an inventory of major systems, implementing common security configurations, ensuring that staff receive information security training, testing and evaluating controls, taking remedial actions where deficiencies are found, and certifying and accrediting systems for operation. The four departments were challenged in several of these areas. For example, Defense is challenged in developing a complete FISMA inventory of systems because it has different definitions of what constitutes a "system." As another example, Homeland Security reported that the tool it uses to report security training counts each course taken, instead of tracking that an individual has taken a specialized course. As a result, the department lacks assurance that all users have received appropriate training. Until the departments address their challenges and fully implement effective departmentwide information security programs, increased risk exists that they will not be able to effectively protect the confidentiality, integrity, and availability of their information and information systems.