FISMA requires each agency to develop, document, and implement an  information security program that includes the following components: periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems; policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements;  subordinate plans for providing adequate information security for  networks, facilities, and systems or group of information systems, as  appropriate; security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies  and procedures, as well as training personnel with significant security  responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems; a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency. The act also requires each agency inspector  general, or other independent auditor, to annually evaluate and report on  the information security program and practices of the agency. OMB’s responsibilities include developing and overseeing the  implementation of policies, principles, standards, and guidelines on  information security in federal agencies (except with regard to national  security systems). Mixed Progress Has Been Made in Implementing Many FISMA Requirements, but Weaknesses Continue in Agencies’ Security Programs

In fiscal year 2012, agencies and their inspectors general reported mixed  progress from fiscal year 2011 in implementing many of the requirements  for establishing an entity-wide information security program. In addition, OMB  and DHS continued to develop reporting metrics and assist agencies in  improving their information security programs; however, the metrics do  not evaluate all FISMA requirements, focused mainly on compliance  rather than effectiveness of controls, and in many cases did not identify  specific performance targets for determining levels of implementation. For example,  in fiscal year 2012, 20 of 24 agencies had weaknesses in periodically  assessing and validating risks. To illustrate, most  major federal agencies had weaknesses in the following information  system controls:
Access controls: In fiscal year 2012, almost all (23 of 24) of the  major federal agencies had weaknesses in the controls that are  intended to limit or detect access to computer resources (data,  programs, equipment, and facilities), thereby protecting them against  unauthorized modification, loss, and disclosure. Although the number of agencies implementing specialized training  programs increased, 16 of 24 inspectors general identified weaknesses  with such programs in fiscal year 2012. According to OMB instructions for FISMA reporting, the DHS  metrics for inspectors general were also designed to measure the  effectiveness of agencies’ information security programs, and OMB relied  on responses by inspectors general to these metrics to gauge the  effectiveness of information security programs. Key contributors to this report are listed in appendix III. We reviewed and analyzed the provisions of the act to identify agency,  Office of Management and Budget (OMB), and National Institute of  Standards and Technology (NIST) responsibilities for implementing,  overseeing, and providing guidance for agency information security to  evaluate federal agencies’ implementation of FISMA requirements.
Why GAO Did This Study

FISMA requires the Comptroller General to periodically report to Congress on agency implementation of the act's provisions. To this end, this report summarizes GAO's evaluation of the extent to which agencies have implemented the requirements of FISMA, including the adequacy and effectiveness of agency information security policies and practices. To do this, GAO analyzed its previous information security reports, annual FISMA reports and other reports from the 24 major federal agencies, reports from inspectors general, and OMB's annual reports to Congress on FISMA implementation. GAO also interviewed agency officials at OMB, DHS, NIST, and 6 agencies selected using the total number of systems the agencies reported in fiscal year 2011.

What GAO Found

In fiscal year 2012, 24 major federal agencies had established many of the components of an information security program required by The Federal Information Security Management Act of 2002 (FISMA); however, they had partially established others. FISMA requires each federal agency to establish an information security program that incorporates eight key components, and each agency inspector general to annually evaluate and report on the information security program and practices of the agency. The act also requires the Office of Management and Budget (OMB) to develop and oversee the implementation of policies, principles, standards, and guidelines on information security in federal agencies and the National Institute of Standards and Technology to develop security standards and guidelines.
The extent to which agencies implemented security program components showed mixed progress from fiscal year 2011 to fiscal year 2012. For example, according to inspectors general reports, the number of agencies that had analyzed, validated, and documented security incidents increased from 16 to 19, while the number able to track identified weaknesses declined from 20 to 15. GAO and inspectors general continue to identify weaknesses in elements of agencies' programs, such as the implementation of specific security controls. For instance, in fiscal year 2012, almost all (23 of 24) of the major federal agencies had weaknesses in the controls that are intended to limit or detect access to computer resources.
OMB and the Department of Homeland Security (DHS) continued to develop reporting metrics and assist agencies in improving their information security programs; however, the metrics do not evaluate all FISMA requirements, such as conducting risk assessments and developing security plans; are focused mainly on compliance rather than effectiveness of controls; and in many cases did not identify specific performance targets for determining levels of implementation. Enhancements to these metrics would provide additional insight into agency information security programs.