FISMA Authorized and Streng

Enacted into law on December 17, 2002, as title III of the E- Government Act of 2002, FISMA authorized and strengthened  information security program, evaluation, and reporting  requirements. Specifically, this program is to include  ●  periodic assessments of the risk and magnitude of harm tha se, disclosure,  could result from the unauthorized access, u disruption, modification, or destruction of information or  information systems;  risk-based policies and procedures that cost-effectively red information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of  each information system, including minimally acceptable system  configuration requirements;  uce  subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information  systems;  security awareness training for agency personnel, including contractors and other users of information systems that support  the operations and assets of the agency;  periodic evaluation of the effectiveness of information security  policies, procedures, and practices, performed with a frequency  depending on risk, but no less than annually, and that includes  testing of management, operational, and technical controls for  every system identified in the agency’s required inventory of  major information systems;  a process for planning, implementing, evaluating, and  documenting remedial action information security policies, procedures, and practice agency;   to address any deficiencies in the  procedures for detecting, reporting, and responding to security  incidents; and  ●  plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of th agency. OMB’s Report to Congress Noted Improvements and Weaknesses

In its March 2006 report to Congress on fiscal year 2005 FISMA  implementation, OMB emphasized that the federal government has  made progress in meeting key performance measures for IT  security; however, uneven implementation of security efforts leaves  weaknesses in several areas. ●  Assessed quality of the certification and accreditation process. Figure 1 illustrates that the major agencies have made steady  progress in fiscal year 2005 certifying and accrediting their systems,  although they have made mixed progress in meeting other key  performance measures compared with the previous two fiscal years. Overall, agencies continued to report that they have not tested a  significant number of their contingency plans with only 61 percent  of systems with tested plans. Without testing, agencies can have limited  assurance that they will be able to recover mission critical  applications, business processes, and information in the event of an  unexpected interruption. Actions are Needed to Improve FISMA Reporting and Underlying Information Security Weaknesses

There are actions that OMB and the agencies can take to improve  FISMA reporting and compliance and to address underlying  weaknesses in information security controls. We  recommended that the Director of OMB take actions in revising  future FISMA reporting instructions to increase the usefulness of  the agencies’ annual reports to oversight bodies by:  ●  requiring agencies to report FISMA data by risk category;  ●  reviewing guidance to ensure the clarity of instructions;  ●  requesting the IGs report on the quality of additional agency  processes, such as the annual system reviews. Such actions should  include completing and maintaining an accurate, complete inventory  of major systems, and prioritizing information security efforts based  on system risk levels. In the 24 major agencies’ fiscal year 2005 reporting regarding their  financial systems, 6 reported information security as a material  weakness and 14 reported it as a reportable condition.
Why GAO Did This Study

For many years, GAO has reported that ineffective information security is a widespread problem that has potentially devastating consequences. In its reports to Congress since 1997, GAO has identified information security as a governmentwide high-risk issue--most recently in January 2005. Concerned with accounts of attacks on commercial systems via the Internet and reports of significant weaknesses in federal computer systems that make them vulnerable to attack, Congress passed the Federal Information Security Management Act of 2002 (FISMA), which permanently authorized and strengthened the federal information security program, evaluation, and reporting requirements established for federal agencies. This testimony discusses the federal government's progress and challenges in implementing FISMA, as reported by the Office of Management and Budget (OMB), the agencies, and the Inspectors General (IGs), and actions needed to improve FISMA reporting and address underlying information security weaknesses.

What GAO Found

In its fiscal year 2005 report to Congress, OMB discusses progress in implementing key information security requirements, but at the same time cites challenging weaknesses that remain. The report notes several governmentwide findings, such as the varying effectiveness of agencies' security remediation processes and the inconsistent quality of agencies' certification and accreditation (the process of authorizing operation of a system, including the development and implementation of risk assessments and security controls). Nevertheless, fiscal year 2005 data reported by 24 major agencies, compared with data reported for the previous 2 fiscal years, show that these agencies have made steady progress in certifying and accrediting systems, although they reported mixed progress in meeting other key statutory information security requirements. For example, agencies reported that only 61 percent of their systems had tested contingency plans, thereby reducing assurance that agencies will be able to recover from the disruption of those systems with untested plans. Federal entities can act to improve the usefulness of the annual FISMA reporting process and to mitigate underlying information security weaknesses. OMB has taken several actions to improve FISMA reporting--such as requiring agencies to provide performance information based on the relative importance or risk of the systems--and can further enhance the reliability and quality of reported information. Agencies also can take actions to fully implement their FISMA-mandated programs and address the weaknesses in their information security controls. Such actions include completing and maintaining accurate inventories of major systems, prioritizing information security efforts based on system risk levels, and strengthening controls that are to prevent, limit, and detect access to the agencies' information and information systems.