CDC Relies on Information Systems to Help Achieve Its Mission

CDC relies extensively on information technology to fulfill its mission and  support related administrative needs. Deficiencies existed in the technical controls and agency-wide  information security program that were intended to (1) identify risk, (2)  protect systems from threats and vulnerabilities, (3) detect cybersecurity  events, (4) respond to these events, and (5) recover system operations. FISMA requires each  agency to develop, document, and implement an information security  program that, among other things, includes the following elements: periodic assessments of the risk and magnitude of the harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems  that support the operations and assets of the agency; policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements; plans for providing adequate information security for networks,  facilities, and systems or group of information systems, as  appropriate;  security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies  and procedures, as well as training personnel with significant security  responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems; a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in the information  security policies, procedures, or practices of the agency; and plans and procedures to ensure continuity of operations for  information systems. CDC Has Implemented Many of the Recommendations in Our June 2018 Report and Plans to Implement the Rest

In our June 2018 report, we made 195 recommendations to CDC to  strengthen its technical security controls and bolster its agency-wide  information security program. Therefore, these  recommendations remain open. Table 3 summarizes the status of CDC’s efforts to implement the 184  recommendations that we made to resolve the technical control  deficiencies, as of August 3, 2018. Fully implementing the  open recommendations is essential to ensuring that the agency’s systems  and sensitive information are not at increased and unnecessary risk of  unauthorized use, disclosure, modification, or disruption. In addition, this report addresses a second objective that was not  included in the June 2018 report. Specifically, this objective was to  determine the extent to which CDC had taken corrective actions to  address the previously identified security program and technical control  deficiencies and related recommendations for improvement that we  identified in the earlier report. As noted in our June 2018 report, we determined the extent to which  CDC had effectively implemented an information security program and  controls to protect the confidentiality, integrity, and availability of its  information on selected information systems.
Why GAO Did This Study

CDC is responsible for detecting and responding to emerging health threats and controlling dangerous substances. In carrying out its mission, CDC relies on information technology systems to receive, process, and maintain sensitive data. Accordingly, effective information security controls are essential to ensure that the agency's systems and information are protected from misuse and modification.
GAO was asked to examine information security at CDC. In June 2018, GAO issued a limited official use only report on the extent to which CDC had effectively implemented technical controls and an information security program to protect the confidentiality, integrity, and availability of its information on selected information systems.
This current report is a public version of the June 2018 report. In addition, for this public report, GAO determined the extent to which CDC has taken corrective actions to address the previously identified security program and technical control deficiencies and related recommendations for improvement. For this report, GAO reviewed supporting documents regarding CDC's actions on previously identified recommendations and interviewed personnel at CDC.

What GAO Found

As GAO reported in June 2018, the Centers for Disease Control and Prevention (CDC) implemented technical controls and an information security program that were intended to safeguard the confidentiality, integrity, and availability of its information systems and information. However, GAO identified control and program deficiencies in the core security functions related to identifying risk, protecting systems from threats and vulnerabilities, detecting and responding to cyber security events, and recovering system operations (see table below). GAO made 195 recommendations to address these deficiencies.
As of August 2018, CDC had made significant progress in resolving many of the security deficiencies by implementing 102 of 184 (about 55 percent) technical control recommendations, and partially implementing 1 of 11 information security program recommendations made in the June 2018 report. The figure shows the status of CDC's efforts to implement the 195 recommendations.
Additionally, CDC has created remedial action plans to implement the majority of the remaining open recommendations by September 2019. Until CDC implements these recommendations and resolves the associated deficiencies, its information systems and information will remain at increased risk of misuse, improper disclosure or modification, and destruction.