	Background

Federal agencies and our nation’s critical infrastructures—such as power  distribution, water supply, telecommunications, national defense, and  emergency services—rely extensively on computerized information  systems and electronic data to carry out their missions. The security of  these systems and data is essential to prevent data tampering, disruptions  in critical operations, fraud, and inappropriate disclosure of sensitive  information. Specifically, this program is to include  periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems;   risk-based policies and procedures that cost effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system;  subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems;   security awareness training for agency personnel, including contractors  and other users of information systems that support the operations and  assets of the agency;   periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, performed with a frequency  depending on risk, but no less than annually, and that includes testing of  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information  systems;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency, through plans of  action and milestones;   procedures for detecting, reporting, and responding to security   plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. Pervasive Weaknesses in Federal Agencies’ Information Security Policies and Practices Place Data at Risk

The 24 major federal agencies continue to have significant control  weaknesses in their computer systems that threaten the integrity,  confidentiality, and availability of federal information and systems. Software Change Controls Were Not Always in Place

Software change controls ensure that only authorized and fully tested  software is placed in operation. Security Programs Were Not Fully Implemented at Agencies

The underlying cause for the information security weaknesses identified at  federal agencies is that they have not yet fully implemented agencywide  information security programs. Government Makes Progress in Implementing FISMA, but Challenges Remain

FISMA provides a comprehensive framework for developing effective  agencywide information security programs. The government is progressing in its implementation of the information  security management requirements of FISMA, but challenges remain. NIST, however, has developed a  schedule for its required activities and has begun to issue required  guidance, and OMB has issued guidance on the roles and responsibilities of  both the agencies and NIST and has also issued annual reporting guidance  and reported annually, as required, to the Congress. Our analysis of the  annual reporting guidance identified opportunities to increase the  usefulness of the reports for oversight. The IGs have conducted annual evaluations as required and have reported  on the results. These weaknesses place  federal operations and assets at risk of fraud, misuse, and abuse, and may  put financial data at risk of unauthorized modification or destruction,  sensitive information at risk of inappropriate disclosure, and critical  operations at risk of disruption. In addition, the  Administrator made several general comments. Objectives, Scope, and Methodology

In accordance with the FISMA requirement that the Comptroller General  report periodically to the Congress, our objectives were to evaluate (1) the  adequacy and effectiveness of agencies’ information security policies and  practices and (2) implementation of FISMA requirements. Information Security: Continued Efforts Needed to Fully Implement  Statutory Requirements.
Why GAO Did This Study

Federal agencies rely extensively on computerized information systems and electronic data to carry out their missions. The security of these systems and data is essential to prevent data tampering, disruptions in critical operations, fraud, and inappropriate disclosure of sensitive information. Concerned with accounts of attacks on systems via the Internet and reports of significant weaknesses in federal computer systems that make them vulnerable to attack, Congress passed the Federal Information Security Management Act (FISMA) in 2002. In accordance with FISMA requirements that the Comptroller General report periodically to the Congress, GAO's objectives in this report are to evaluate (1) the adequacy and effectiveness of agencies' information security policies and practices and (2) the federal government's implementation of FISMA requirements.

What GAO Found

Pervasive weaknesses in the 24 major agencies' information security policies and practices threaten the integrity, confidentiality, and availability of federal information and information systems. Access controls were not effectively implemented; software change controls were not always in place; segregation of duties was not consistently implemented; continuity of operations planning was often inadequate; and security programs were not fully implemented at the agencies. These weaknesses exist primarily because agencies have not yet fully implemented strong information security management programs. These weaknesses put federal operations and assets at risk of fraud, misuse, and destruction. In addition, they place financial data at risk of unauthorized modification or destruction, sensitive information at risk of inappropriate disclosure, and critical operations at risk of disruption. Overall, the government is making progress in its implementation of FISMA. To provide a comprehensive framework for ensuring the effectiveness of information security controls, FISMA details requirements for federal agencies and their inspectors general (IG), the National Institute of Standards and Technology (NIST), and OMB. Federal agencies reported that they have been increasingly implementing required information security practices and procedures, although they continue to face major challenges. Further, IGs have conducted required annual evaluations, and NIST has issued required guidance in the areas of risk assessments and recommended information security controls, and has maintained its schedule for issuing remaining guidance required under FISMA. Finally, OMB has given direction to the agencies and reported to Congress as required; however, GAO's analysis of its annual reporting guidance identified opportunities to increase the usefulness of the reports for oversight. While progress has been made in implementing statutory requirements, agencies continue to have difficulty effectively protecting federal information and information systems.