Furthermore,  many can be easily forged or stolen and altered to permit access by  unauthorized individuals. HSPD-12 Requires Standardized Agency ID and Credentialing Systems

In August 2004, the President issued HSPD-12, which required the  Department of Commerce to develop a new standard for secure and  reliable forms of ID for federal employees and contractors by February 27,  2005. Agencies  are required to begin issuing credentials that meet these provisions by  October 27, 2006. Their primary focus has been on actions to address the first part  of the standard, including establishing appropriate identity proofing and  card issuance policies and procedures. For example, five of the six  agencies had instituted policies to require that at least a successful  fingerprint check be completed prior to issuing a credential; and the sixth  agency, Defense, was in the process of having such a policy instituted. Regarding other requirements, efforts were still under way. For example,  Defense and NASA reported that they were still making modifications to  their background check policies. Agencies have begun to take actions to address the second part of the  standard, which focuses on interoperable smart card systems. Defense and  Interior, for example, have conducted assessments of technological gaps  between their existing systems and the infrastructure required by FIPS 201,  but they have not yet developed specific designs for card systems that meet  FIPS 201 interoperability requirements. The Federal Government Faces Challenges in Implementing FIPS 201

The federal government faces a number of significant challenges to  implementing FIPS 201, including testing and acquiring compliant products  within OMB’s mandated time frames; reconciling divergent implementation  specifications; assessing risks associated with implementing the recently- chosen biometric standard; incomplete guidance regarding the  applicability of FIPS 201 to facilities, people, and information systems; and  planning and budgeting with uncertain knowledge and the potential for  substantial cost increases. Without more complete time frames and  guidance, agencies may not be able to meet implementation deadlines; and  more importantly, true interoperability among federal government  agencies’ smart card programs—one of the major goals of FIPS 201—could  be jeopardized. Further, we also recommend that the Director, OMB, amend or supplement  governmentwide policy guidance regarding compliance with the FIPS 201  standard to take the following three actions:  provide specific deadlines by which agencies implementing transitional  smart card systems are to meet the “end-point” specification, thus  allowing for interoperability of smart card systems across the federal  government;  provide guidance to agencies on assessing risks associated with the  variation in the reliability and accuracy among biometric products, so  that they can select vendors that best meet the needs of their agencies  while maintaining interoperability with other agencies, and  clarify the extent to which agencies should make risk-based  assessments regarding the applicability of FIPS 201 to specific types of  facilities, individuals, and information systems, such as small offices,  foreign nationals, and volunteers. Objectives, Scope, and Methodology

Our objectives were to determine (1) actions that selected federal agencies  have taken to implement the new standard and (2) challenges that federal  agencies are facing in implementing the standard. The agencies we selected were the  Departments of Defense, Interior, Homeland Security (DHS), Housing and  Urban Development (HUD), Labor, and the National Aeronautics and Space  Administration (NASA).
Why GAO Did This Study

Many forms of identification (ID) that federal employees and contractors use to access government-controlled buildings and information systems can be easily forged, stolen, or altered to allow unauthorized access. In an effort to increase the quality and security of federal ID and credentialing practices, the President directed the establishment of a governmentwide standard--Federal Information Processing Standard (FIPS) 201--for secure and reliable forms of ID based on "smart cards" that use integrated circuit chips to store and process data with a variety of external systems across government. GAO was asked to determine (1) actions that selected federal agencies have taken to implement the new standard and (2) challenges that federal agencies are facing in implementing the standard.

What GAO Found

The six agencies we reviewed--Defense, Interior, Homeland Security, Housing and Urban Development (HUD), Labor, and the National Aeronautics and Space Administration (NASA)--had each taken actions to begin implementing the FIPS 201 standard. Their primary focus has been on actions to address the first part of the standard, which calls for establishing appropriate identity proofing and card issuance policies and procedures and which the Office of Management and Budget (OMB) required agencies to implement by October 27, 2005. Agencies had completed a variety of actions, such as instituting policies to require that at least a successful fingerprint check be completed prior to issuing a credential. Regarding other requirements, however, efforts were still under way. For example, Defense and NASA reported that they were still modifying their background check policies. Based on OMB guidance, agencies have until October 27, 2006, to implement the second part of the standard, which requires them to implement interoperable smart-card based ID systems. Agencies have begun to take actions to address this part of the standard. For example, Defense and Interior conducted assessments of technological gaps between their existing systems and the infrastructure required by FIPS 201 but had not yet developed specific designs for card systems that meet FIPS 201 interoperability requirements. The federal government faces significant challenges in implementing FIPS 201, including (1) testing and acquiring compliant commercial products--such as smart cards and card readers--within required time frames; (2) reconciling divergent implementation specifications; (3) assessing the risks associated with specific vendor implementations of the recently chosen biometric standard; (4) incomplete guidance regarding the applicability of FIPS 201 to facilities, people, and information systems; and (5) planning and budgeting with uncertain knowledge and the potential for substantial cost increases. Until these implementation challenges are addressed, the benefits of FIPS 201 may not be fully realized. Specifically, agencies may not be able to meet implementation deadlines established by OMB, and more importantly, true interoperability among federal government agencies' smart card programs--one of the major goals of FIPS 201--may not be achieved.