OMB Initiated FDCC and Provided Guidance for Agency Implementation

To help carry out its responsibilities for ensuring federal information  security, OMB launched the FDCC initiative in March 2007. Submit FDCC compliance reports to NIST by March 31, 2008. Agencies Have Not Fully Implemented FDCC Settings, but Most Have Complied with Other Requirements

None of the agencies has fully implemented all FDCC configuration  settings on all applicable workstations, although most have complied with  other requirements. Table 1 shows how many agencies addressed each of the required actions  in their FDCC implementation plans. Most Agencies Documented Deviations, but Eight Did Not Establish a Policy for Approving Them

Although OMB guidance indicates that agencies are to document and have  a designated accrediting authority approve deviations from FDCC, several  agencies did not do so. In addition, agencies continue to face  significant challenges in meeting FDCC requirements, monitoring their  implementation of the settings, and measuring benefits of the initiative,  among other things. Implementing FDCC Can Enhance Security at Federal Agencies

FDCC has the potential both to increase agencies’ information security  and to standardize their management of workstations. FDCC implementation enhances security by requiring stricter security  settings on workstations than those that may have been previously in  place at federal agencies. For example, a more secure enterprisewide Windows configuration and  consistent workstation profile (i.e., the set of configuration settings and  other software applied to a workstation) across the agency can not only  improve security but can also make it easier to manage changes to the  security features of workstation software, such as applying updates or  patches. Lessons Learned

There are a number of lessons to be learned from the management and  implementation of the FDCC initiative which, if considered, could improve  the implementation of future versions of FDCC or other configuration  efforts. Challenges Exist for Agencies in Fully Complying with FDCC Requirements

Agencies face several ongoing challenges to fully complying with FDCC  requirements, including retrofitting their existing applications and systems  to comply with the settings, assessing the risks associated with deviations,  and monitoring workstations to ensure that the settings are applied and  functioning properly. Specifically, many agencies have applied an agency-defined subset  of the configuration settings to their Windows workstations; however,  none of the 24 major agencies has fully applied all the FDCC settings. Unless  agencies fulfill these requirements, OMB will not be able to ensure the  effectiveness of the initiative. As OMB  establishes additional versions of FDCC settings—or configuration  settings for other applications or operating systems—understanding the  lessons learned from implementation as well as the ongoing challenges  agencies face will be essential to the initiative’s success in ensuring public  confidence in the confidentiality, integrity, and availability of government  information. Appendix I: Objectives, Scope, and Methodology

Relative to the 24 major federal agencies covered by the Chief Financial  Officers Act, the objectives of our review were to (1) identify the goals,  objectives, and requirements for the initiative; (2) determine the status of  actions federal agencies have taken, or plan to take, to implement the  initiative; and (3) identify the benefits, challenges, and lessons learned in  implementing this initiative. To address our first objective, we reviewed applicable policies and  memorandums issued by the Office of Management and Budget (OMB)  and plans, artifacts, and other documentation provided by the National  Institute of Standards and Technology (NIST). Energy

To improve the department’s implementation of FDCC, we recommend  that the Secretary of Energy take the following five actions:    complete implementation of the agency’s FDCC baseline, including  establishing firm milestones for completion;    document deviations to FDCC and have them approved by a designated    ensure all components that are required to implement FDCC have  acquired and deployed a NIST-validated SCAP tool to monitor compliance  with FDCC;    ensure all components that are required to implement FDCC develop,  document, and implement a policy to monitor FDCC compliance using a  NIST-validated SCAP tool; and    ensure that language is included in contracts of those components that are  required to implement FDCC to ensure new acquisitions include FDCC  settings and products of information technology providers operate  effectively using them. 4. 2.
Why GAO Did This Study

The increase in security incidents and continuing weakness in security controls on information technology systems at federal agencies highlight the continuing need for improved information security. To standardize and strengthen agencies' security, the Office of Management and Budget (OMB), in collaboration with the National Institute of Standards and Technology (NIST), launched the Federal Desktop Core Configuration (FDCC) initiative in 2007. GAO was asked to (1) identify the goals, objectives, and requirements of the initiative; (2) determine the status of actions federal agencies have taken, or plan to take, to implement the initiative; and (3) identify the benefits, challenges, and lessons learned in implementing this initiative. To accomplish this, GAO reviewed policies, plans, and other documents at the 24 major executive branch agencies; reviewed OMB and NIST guidance and documentation; and interviewed officials.

What GAO Found

The goals of FDCC are to improve information security and reduce overall information technology operating costs across the federal government by, among other things, providing a baseline level of security through the implementation of a set of standard configuration settings on government-owned desktop and laptop computers (i.e., workstations). To carry out the initiative, OMB required that executive branch agencies take several actions, including: (1) submit an implementation plan to OMB; (2) apply all configuration settings to all applicable workstations by February 2008; (3) document any deviations from the prescribed settings and have them approved by an accrediting authority; (4) acquire a specified NIST-validated tool for monitoring implementation of the settings; (5) ensure that future information technology acquisitions comply with the configuration settings; and (6) submit a status report to NIST. While agencies have taken actions to implement these requirements, none of the agencies has fully implemented all configuration settings on their applicable workstations. Specifically, most plans submitted to OMB did not address all key implementation activities; none of the agencies implemented all of the prescribed configuration settings on all applicable workstations, though several implemented agency-defined subsets of the settings; several agencies did not fully document their deviations from the settings or establish a process for approving them; six agencies did not acquire and make use of the required tool for monitoring FDCC compliance; many agencies did not incorporate language into contracts to ensure that future information technology acquisitions comply with FDCC; and many agencies did not describe plans for eliminating or mitigating their deviations in their compliance reports to NIST. Until agencies ensure that they are meeting these FDCC requirements, the effectiveness of the initiative will be limited. FDCC has the potential to increase agencies' information security by requiring stricter security settings on workstations than those that may have been previously in place and standardizing agencies' management of workstations, making it easier to manage changes such as applying updates or patches. In addition, a number of lessons can be learned from the management and implementation of the FDCC initiative which, if considered, could improve the implementation of future versions of FDCC or other configuration efforts. At the same time, agencies face several ongoing challenges in fully complying with FDCC requirements, including retrofitting applications and systems in their existing environments to comply with the settings, assessing the risks associated with deviations, and monitoring workstations to ensure that the settings are applied and functioning properly. As OMB moves forward with the initiative, understanding the lessons learned as well as the ongoing challenges agencies face will be essential in order to ensure the initiative is successful in ensuring public confidence in the confidentiality, integrity, and availability of government information.