Information Security: Weaknesses Persist at Federal Agencies Despite Progress Made in Implementing Related Statutory Requirements
GAO-05-552
Published: Jul 15, 2005. Publicly Released: Jul 15, 2005.
Skip to Highlights
Highlights
Federal agencies rely extensively on computerized information systems and electronic data to carry out their missions. The security of these systems and data is essential to prevent data tampering, disruptions in critical operations, fraud, and inappropriate disclosure of sensitive information. Concerned with accounts of attacks on systems via the Internet and reports of significant weaknesses in federal computer systems that make them vulnerable to attack, Congress passed the Federal Information Security Management Act (FISMA) in 2002. In accordance with FISMA requirements that the Comptroller General report periodically to the Congress, GAO's objectives in this report are to evaluate (1) the adequacy and effectiveness of agencies' information security policies and practices and (2) the federal government's implementation of FISMA requirements.
Recommendations
Recommendations for Executive Action
| Agency Affected Sort descending | Recommendation | Status |
|---|---|---|
| Office of Management and Budget | In revising future FISMA reporting guidance, the Director of OMB should request the inspectors general to report on the quality of additional agency processes, such as the annual system reviews. |
Closed – Implemented
OMB revised its fiscal year 2009 FISMA reporting instructions to request that inspectors general provide information on the quality of the agency?s certification and accreditation (C&A) process. This qualitative information included whether the agency has an adequate C&A policy and whether the C&A process adequately provides appropriate risk categories, testing of controls (covers annual system reviews), and other items. As a result, the usefulness of the review process for management and oversight purposes is enhanced.
|
| Office of Management and Budget | In revising future FISMA reporting guidance, the Director of OMB should require agencies to report FISMA data by risk category. |
Closed – Implemented
In our July 15, 2005 report on federal agencies' implementation of FISMA, we recommended that OMB require agencies to report FISMA data by risk category. For the subsequent reporting cycle (agencies reporting in 2006 on FY 2005 activities) OMB issued reporting instructions and templates that required agencies to list systems by risk category. OMB's actions thereby implement GAO's recommendation.
|
| Office of Management and Budget | In revising future FISMA reporting guidance, the Director of OMB should ensure that all aspects of key FISMA requirements are reported on in the annual reports. |
Closed – Implemented
OMB revised its fiscal year 2009 FISMA reporting instructions to request that inspectors general provide information on the quality of the agency?s certification and accreditation (C&A) process. This qualitative information included whether the agency has an adequate C&A policy and whether the C&A process adequately provides appropriate risk categories, testing of controls (covers annual system reviews), and other items. As a result, the usefulness of the review process for management and oversight purposes is enhanced.
|
| Office of Management and Budget | In revising future FISMA reporting guidance, the Director of OMB should review guidance to ensure clarity of instructions. |
Closed – Implemented
In our July 15, 2005 report on federal agencies' implementation of FISMA, we recommended that OMB review guidance to ensure clarity of instructions. For the subsequent reporting cycle (agencies reporting in 2006 on FY 2005 activities) OMB clarified or deleted comments related to POA&Ms, system inventories, and configuration management. The FY 2005 reporting templates deleted some elements of the POA&M question present in the FY 2004 version. Additionally, the FY 2005 template eliminated the system inventory question for the Inspector General that asked about the IG's involvement in development and verification. Also, the FY 2005 template included a more detailed question on configuration management than the FY 2004 template, requiring agencies to identify which software is addressed in agencywide policy and whether agency systems run the software. OMB's actions thereby implement GAO's recommendation.
|
Full Report
GAO Contacts
Office of Public Affairs
Topics
Computer fraudComputer security policiesContinuity of operationsContinuity of operations planEvaluation methodsInformation securityInformation security managementInformation security regulationsInternal controlsPolicy evaluationRegulatory agenciesReporting requirementsRisk assessmentSecurity policiesStandardsStrategic information systems planningSystems evaluation