We made four recommendations to  VA: (1) complete a comprehensive security management program that  included actions related to central security management functions, risk  assessments, security policies and procedures, security awareness, and  monitoring and evaluating computer controls; (2) develop a process for  managing the department’s updated security plan to remediate identified  weaknesses; (3) regularly report to the Secretary, or his designee, on  progress in implementing VA’s security plan; and (4) ensure consistent use  of information security performance standards when appraising the  department’s senior executives. VA Has Not Fully Implemented GAO and IG Recommendations

Although VA has made progress, it has not yet fully or effectively  implemented two of four GAO recommendations and has not fully  implemented 20 of 22 IG recommendations to strengthen its information  security practices. Because these recommendations have not yet been  implemented, unnecessary risk exists that personal information of  veterans and others would be exposed to data tampering, fraud, and  inappropriate disclosure. However, it has not  fully implemented two other GAO recommendations. However, the department has not  completed critical management activities to implement 15 of the 17  recommendations made by the IG in September 2006, which were carried  forward from its March 2005 report, to appropriately restrict access to  data, networks, and VA facilities; ensure that only authorized changes and  updates to computer programs are made; strengthen critical infrastructure  planning to ensure information security requirements are addressed; and  ensure that background investigations are conducted on all applicable  employees and contractors. By Not Fully Implementing GAO and IG Recommendations, VA Leaves Personal Information Vulnerable

The need to fully implement GAO and IG recommendations to strengthen  information security practices is underscored by the prevalence of  security incidents involving the unauthorized disclosure, misuse, or loss of  personal information of veterans and other individuals, such as medical  providers. VA Is Undertaking Several Major Initiatives to Strengthen Information Security, but Implementation Has Shortcomings

VA has begun or continued several major initiatives since the May 2006  security incident to strengthen information security practices and secure  personal information within the department, but more remains to be done. Since October 2005, VA has been reorganizing its management structure to  provide better oversight and fiscal discipline over its IT systems, and it has  undertaken a series of new initiatives. For example,  although VA has developed a remedial action plan that includes tasks to  develop, document, revise, or update a policy or program, 87 percent of  these do not have an established time frame for implementation across the  department. Until the process and  responsibilities for coordinating the management and implementation of  IT security policies and procedures throughout the department are clearly  documented, VA will have limited assurance that the management and  implementation of security policies and procedures are effectively  coordinated and communicated. For 87 percent of action items  related to policies and procedures, the action plan included no  corresponding task with an established time frame for departmentwide  implementation. As a result, the office lacks a process to ensure that its examination of  internal controls is consistent across VA facilities. Until VA addresses recommendations to resolve identified  weaknesses, it will have limited assurance that it can adequately protect  its systems and information. Document clearly defined responsibilities in the organization book for  the Director of Field Operations and Security and the Director of Cyber  Security for coordinating the implementation of IT security policies  and procedures within the department. Act expeditiously to fill the position of the Chief Information Security  Officer. Develop, document, and implement clear guidance for identifying  devices that require encryption functionality. Key contributors to this report are listed in  appendix V.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to evaluate (1) whether the Department of Veterans  Affairs (VA) has effectively addressed GAO and VA Office of Inspector  General (IG) recommendations to strengthen its information security  practices and (2) actions VA has taken since the May 2006 security  incident to strengthen its information security practices and secure  personal information. An office determined it was missing a backup tape  containing sensitive information.
Why GAO Did This Study

In May 2006, the Department of Veterans Affairs (VA) announced that computer equipment containing personal information on approximately 26.5 million veterans and active duty military personnel had been stolen. Given the importance of information technology (IT) to VA's mission, effective information security controls are critical to maintaining public and veteran confidence in its ability to protect sensitive information. GAO was asked to evaluate (1) whether VA has effectively addressed GAO and VA Office of Inspector General (IG) information security recommendations and (2) actions VA has taken since May 2006 to strengthen its information security practices and secure personal information. To do this, GAO examined security policies and action plans, interviewed pertinent department officials, and conducted testing of encryption software at select VA facilities.

What GAO Found

Although VA has made progress, it has not yet fully implemented most of the key GAO and IG recommendations to strengthen its information security practices. Specifically, VA has implemented two GAO recommendations: to develop a process for managing its plan to correct identified weaknesses and to regularly report on progress in updating its security plan to the Secretary. However, it has not fully implemented two other GAO recommendations: to complete a comprehensive security management program and to ensure consistent use of information security performance standards for appraising senior VA executives. In addition, the department has not yet fully implemented 20 of 22 recommendations made by the IG in 2006. For example, VA has not completed activities to appropriately restrict access to data, networks, and department facilities; ensure that only authorized changes and updates to computer programs are made; and strengthen critical infrastructure planning. Because these recommendations have not yet been implemented, unnecessary risk exists that the personal information of veterans and others, such as medical providers, will be exposed to data tampering, fraud, and inappropriate disclosure. Since the May 2006 security incident, VA has continued or begun several major initiatives to strengthen its information security practices and secure personal information within the department, but more remains to be done. These initiatives include continuing efforts begun in October 2005 to reorganize its management structure to provide better oversight and fiscal discipline over its IT systems; developing an action plan to correct identified weaknesses; establishing an information protection program; improving its incident management capability; and establishing an office responsible for oversight of IT within the department. However, implementation shortcomings limit the effectiveness of these initiatives. For example, no documented process exists between the Director of Field Operations and Security and the chief information security officer (CISO) to ensure the effective coordination and implementation of security policies and procedures within the department. In addition, the position of the CISO has been unfilled since June 2006. Although, 39 percent of items in the department's remedial action plan are tasks to develop, document, revise, or update a policy or program, 87 percent of these items have no corresponding task with an established time frame for implementation across the department. VA also did not have clear guidance for identifying devices that require encryption functionality, and it lacked adequate procedures for incident response and notification. Finally, VA's Office of IT Oversight and Compliance lacks a standard methodology and established criteria to ensure that its examination of internal controls is consistent across VA facilities. Until the department addresses recommendations to resolve identified weaknesses and implements the major initiatives it has undertaken, it will have limited assurance that it can protect its systems and information from the unauthorized disclosure, misuse, or loss of personal information of veterans and other personnel.