A lack of oversight and inconsistent implementation of DOD's information security program are increasing the risk of misclassification. DOD's information security program is decentralized to the DOD component level, and the Office of the Under Secretary of Defense for Intelligence (OUSD(I)), the DOD office responsible for DOD's information security program, has limited involvement with, or oversi

Our fiscal year 2005 audit procedures identified opportunities to strengthen certain information security controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt. Specifically, our audit procedures identified 11 new general information security control issues that relate to access controls and system software. In the Limited Official Use Only report, w

The CIOs of most of the 20 leading private-sector organizations GAO met with had either sole or shared responsibility for 9 of the 12 information and technology management functional areas. Almost all of the private-sector CIOs had responsibility for five areas: (1) systems acquisition, (2) IT capital planning, (3) information security, (4) IT human capital, and (5) e-commerce. In only three area

Although DLA has made progress in implementing important elements of its information security program, including establishing a central security management group and appointing a senior information security officer to manage the program, it has not yet fully implemented other essential elements. For example, the agency did not consistently assess risks for its information systems; sufficiently tr

FAA has made progress in implementing information security for its air traffic control information systems; however, GAO identified significant security weaknesses that threaten the integrity, confidentiality, and availability of FAA's systems--including weaknesses in controls that are designed to prevent, limit, and detect access to these systems. The agency has not adequately managed its networ

DHS has not fully implemented a comprehensive, departmentwide information security program to protect the information and information systems that support its operations and assets. It has developed and documented departmental policies and procedures that could provide a framework for implementing such a program; however, certain departmental components have not yet fully implemented key informat

The main technology components of an RFID system are a tag, reader, and database. A reader scans the tag for data and sends the information to a database, which stores the data contained on the tag. The use of tags and databases raises important security considerations related to the confidentiality, integrity, and availability of the data on the tags, in the databases, and in how this informatio

The main technology components of an RFID system are a tag, reader, and database. A reader scans the tag for data and sends the information to a database, which stores the data contained on the tag. The major initiatives at federal agencies that use or propose to use the technology include physical access control and tracking assets, documents, or materials. For example, the Department of Homelan

Contractors and users with privileged access to federal data and systems provide valuable services that contribute to the efficient functioning of the government, but a range of risks (including operational, strategic, and legal) must be managed effectively. Most agencies recognize risks to the confidentiality, integrity, and availability of their information and systems associated with the use o

Our fiscal year 2004 audit procedures identified opportunities to strengthen certain information security controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt. Specifically, our audit procedures identified six new general information security control issues that relate to access controls. In the Limited Official Use Only report, we made six recommen