GAO/AIMD-00-197R Software Change Controls at OPM

B-285553

June 30, 2000

Ms. Janet Barnes

Chief Information Officer

Office of Personnel Management

Subject: Information Security: Software Change Controls at the Office of Personnel

Management

Dear Ms. Barnes:

This letter summarizes the results of our recent review of software change controls at the

Office of Personnel Management (OPM). Controls over access to and modification of

software are essential in providing reasonable assurance that system-based security controls

are not compromised. Without proper software change controls, there are risks that security

features could be inadvertently or deliberately omitted or rendered inoperable, processing

irregularities could occur, or malicious code could be introduced. If related personnel policies

for background checks and system access controls are not adequate, there is a risk that

untrustworthy and untrained individuals may have unrestricted access to software code,

terminated employees may have the opportunity to compromise systems, and unauthorized

actions may not be detected.

OPM was 1 of 16 agencies included in a broader review of federal software change controls

that we conducted in response to a request by Representative Stephen Horn, Chairman,

Subcommittee on Government Management, Information and Technology, House Committee

on Government Reform. The objectives of this broader review were to determine (1) whether

key controls as described in agency policies and procedures regarding software change

authorization, testing, and approval complied with federal guidance and (2) the extent to

which agencies contracted for Year 2000 remediation of mission-critical systems and

involved foreign nationals in these efforts. The aggregate results of our work were reported in

Information Security: Controls Over Software Changes at Federal Agencies (GAO/AIMD00-151R, May 4, 2000), which we are sending with this letter.

For the OPM segment of our review, we interviewed Year 2000 project staff at the two OPM

components—Retirement and Insurance Service Systems (RISS) and the Non Retirement and

Insurance Service Systems—responsible for remediation of software for OPM’s 107 missionUnited States General Accounting Office

Washington, DC 20548

Accounting and Information

Management Division
B-285553

2 GAO/AIMD-00-197R Software Change Controls at OPM

critical systems. We also obtained pertinent written policies and procedures from these

components and compared them to federal guidance issued by the Office of Management and

Budget (OMB) and the National Institute of Standards and Technology. We did not observe

the components’ practices or test their compliance with their policies and procedures. We

performed our work from January through March 2000 in accordance with generally accepted

government auditing standards.

According to OPM officials, background checks of personnel involved in the software change

process were a routine security control for contractor personnel involved in making changes

to software. Also, officials told us that all four contracts for remediation services included

provisions for background checks of contractor staff. However, we identified weaknesses

regarding formal policies and procedures and contract oversight.

• Office-level guidance for routine software change control did not exist, and formally

documented component procedures for Year 2000 software changes were inadequate.

Procedures developed by both OPM components for Year 2000 remediation of software

did not adequately address key controls for operating system software access and

monitoring.

• Based on our interviews, agency officials were not familiar with contractor practices for

software management. This is of potential concern because 65 (61 percent) of OPM’s 107

mission-critical federal systems involved the use of contractors for Year 2000

remediation. Also of concern is that RISS sent code associated with 7 mission-critical

systems to a contractor facility for remediation, and agency officials could not readily

determine how the code was protected after transit to the contractor facility, when the

code was out of the agency’s direct control.

• OPM officials did not have complete data on the involvement of foreign nationals in

software change process activities. However, officials told us that one of two contracts

issued by RISS for remediation of 57 mission-critical systems involved foreign nationals.

We requested comments on a draft of this letter from your office. You provided us with

written comments that are included in the enclosure. In your comments, you stated that OPM

is actively improving system development procedures to reflect the Carnegie Mellon

University Software Engineering Institute’s Capability Maturity Model for Software (SWCMM) and that you have set an ultimate goal to achieve a SW-CMM level 3 process.1 We

encourage you to proceed on this course.

In addition, we suggest that you review related contract oversight and personnel policies and

practices and implement any changes that you deem necessary. Because we also identified

software control weaknesses at other agencies covered by our review, we have recommended

1 The Capability Maturity Model is organized into five levels that characterize an organization’s software

process maturity. These levels range from initial (level 1), characterized by ad hoc and chaotic processes, to

optimizing (level 5), characterized by continuous process improvement based upon analysis and quantitative

data. Level 3 is described as the defined level, in which the software process for both management and

engineering activities is documented, standardized, and integrated.
B-285553

3 GAO/AIMD-00-197R Software Change Controls at OPM

that OMB clarify its guidance to agencies regarding software change controls as part of

broader revisions that OMB is currently developing to Circular A-130, Management of

Federal Information Resources.

We appreciate OPM’s participation in this study and the cooperation we received from

officials at your office and at the OPM components covered by our review. If you have any

questions, please contact me at (202) 512-6240 or by e-mail at mcclured.aimd@gao.gov, or

you may contact Jean Boltz, Assistant Director, at (202) 512-5247 or by e-mail at

boltzj.aimd@gao.gov.

Sincerely yours,

David L. McClure

Associate Director, Governmentwide

and Defense Information Systems

Enclosure
Enclosure

4 GAO/AIMD-00-197R Software Change Controls at OPM
Enclosure

5 GAO/AIMD-00-197R Software Change Controls at OPM
Enclosure

6 GAO/AIMD-00-197R Software Change Controls at OPM

(511988)