Federal Information Security: Agencies Need to Correct Weaknesses and Fully Implement Security Programs
Published: 2015-09-29T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Since 1997, GAO has designated federal information security as a government-wide high risk area, and in 2003 expanded this area to include computerized systems supporting the nation's critical infrastructure. In February 2015, in its high risk update, GAO further expanded this area to include protecting the privacy of personal information that is collected, maintained, and shared by both federal and nonfederal entities.
FISMA required federal agencies to develop, document, and implement an agency-wide information security program. The act also assigned OMB with overseeing agencies' implementation of security requirements.
FISMA also included a provision for GAO to periodically report to Congress on (1) the adequacy and effectiveness of agencies' information security policies and practices and (2) agencies' implementation of FISMA requirements. GAO analyzed information security-related reports and data from 24 federal agencies, their inspectors general, and OMB; reviewed prior GAO work; examined documents from OMB and DHS; and spoke to agency officials.
section_title: What GAO Found
paragraphs: Persistent weaknesses at 24 federal agencies illustrate the challenges they face in effectively applying information security policies and practices. Most agencies continue to have weaknesses in (1) limiting, preventing, and detecting inappropriate access to computer resources; (2) managing the configuration of software and hardware; (3) segregating duties to ensure that a single individual does not have control over all key aspects of a computer-related operation; (4) planning for continuity of operations in the event of a disaster or disruption; and (5) implementing agency-wide security management programs that are critical to identifying control deficiencies, resolving problems, and managing risks on an ongoing basis (see fig.). These deficiencies place critical information and information systems used to support the operations, assets, and personnel of federal agencies at risk, and can impair agencies' efforts to fully implement effective information security programs. In prior reports, GAO and inspectors general have made hundreds of recommendations to agencies to address deficiencies in their information security controls and weaknesses in their programs, but many of these recommendations remain unimplemented.
Federal agencies' implementation in fiscal years 2013 and 2014 of requirements set by the Federal Information Security Management Act of 2002 (FISMA) was mixed. For example, most agencies had developed and documented policies and procedures for managing risk, providing security training, and taking remedial actions, among other things. However, each agency's inspector general reported weaknesses in the processes used to implement FISMA requirements. In addition, to comply with FISMA's annual reporting requirements, the Office of Management and Budget (OMB) and the Department of Homeland Security (DHS) provide guidance to the inspectors general on conducting and reporting agency evaluations. Nevertheless, GAO found that this guidance was not always complete, leading to inconsistent application by the inspectors general. For example, because it did not include criteria for making overall assessments, inspectors general inconsistently reported agency security performance.
section_title: What GAO Recommends
paragraphs: GAO is recommending that OMB, in consultation with DHS and others, enhance security program reporting guidance to inspectors general so that the ratings of agency security performance will be consistent and comparable. OMB generally concurred with our recommendation.

section_title: Letter
paragraphs: The widespread use of the Internet has changed the way that our  government, our nation, and the rest of the world communicate and  conduct business. While the benefits have been enormous, this  connectivity—without effective cybersecurity—can also pose significant  risks to computer systems and networks as well as to the critical  operations and key infrastructures they support. Resources may be lost,  information—including sensitive personal information—may be  compromised, and the operations of government and critical  infrastructures could be disrupted, with potentially catastrophic effects.
The emergence of increasingly sophisticated cyber threats underscores  the need to manage and bolster the security of federal information  systems. For example, advanced persistent threats—where an adversary  that possesses sophisticated levels of expertise and significant resources  can attack using multiple means such as cyber, physical, or deception to  achieve its objectives—pose increasing risks. In addition, the number and  types of cyber threats are on the rise. The recent attack on federal  personnel and background investigation files that breached the personally  identifiable information (PII) for more than 20 million federal employees  and contractors illustrates the need for strong security over information  and systems. Further, in February 2015, the Director of National  Intelligence testified that cyber threats to U.S. national and economic  security are increasing in frequency, scale, sophistication, and severity of  impact.
Since 1997, we have designated federal information security as a  government-wide high-risk area, and in 2003, expanded this area to  include computerized systems supporting the nation’s critical  infrastructure. In our 2015 High-Risk update, we further expanded this  area to include protecting the privacy of PII.
The Federal Information Security Management Act of 2002 (FISMA 2002)  established information security program and evaluation requirements for  federal agencies in the executive branch. FISMA 2002 also assigned  specific responsibilities to the Office of Management and Budget (OMB)  and the National Institute of Standards and Technology (NIST). Each  year, each federal agency is to have performed an independent  evaluation of the information security program and practices of that  agency to determine the effectiveness of such program and practices.  The results of the evaluation, performed by the agency’s inspector  general or independent external auditor, are to be reported annually to  OMB, selected congressional committees, and the Comptroller General  and are to address the adequacy of information security policies,  procedures, practices, and compliance with requirements. The act also  included a provision for GAO to periodically report to Congress on agency  implementation of the act’s provisions. FISMA 2002 was updated in 2014  by the Federal Information Security Modernization Act of 2014. Because  FISMA 2002 requirements were in effect during the time period of our  review, we are evaluating agencies’ implementation of those  requirements in this report. We will refer to the 2002 law as FISMA 2002  and the Federal Information Security Modernization Act of 2014 as  FISMA 2014. Changes in information security requirements under FISMA  2014 are discussed later in this section.
Our objectives were to evaluate (1) the adequacy and effectiveness of  agencies’ information security policies and practices and (2) federal  agencies’ implementation of FISMA 2002 requirements. To do this, we  reviewed and analyzed the provisions of FISMA 2002 to identify  responsibilities for implementing, overseeing, and providing guidance for  agency information security. We also compared requirements for FISMA  2002 against those in FISMA 2014 to identify revised roles and  responsibilities for OMB, the Department of Homeland Security (DHS),  and federal agencies. We also analyzed our previous information security  reports, annual agency FISMA reports, and agency financial and  performance and accountability reports from the 24 federal agencies  covered by the Chief Financial Officers Act, reports from the 24  agencies’ Offices of Inspector General, OMB’s annual reports to  Congress on FISMA 2002 implementation, and NIST security publications  issued for or during fiscal years 2013 and 2014. Where possible, we  categorized findings from those reports according to information security  program requirements prescribed by FISMA 2002 and security control  areas defined by our Federal Information System Controls Audit  Manual. We also reviewed OMB and DHS’ annual FISMA reporting  guidance and OMB’s annual reports to Congress for fiscal years 2013  and 2014 FISMA implementation. In addition, we analyzed, categorized,  and summarized the annual FISMA data submissions for fiscal years  2013 and 2014 by each agency’s chief information officer, inspector  general, and senior agency official for privacy. We selected six agencies  to determine the reliability of agency-submitted data. These agencies  were selected to reflect a range in the number of systems agencies  reported in fiscal year 2013 and include the Departments of Commerce,  State, and Treasury; the General Services Administration; the National  Science Foundation; and the Social Security Administration. While not  generalizable to all agencies, the information we collected and analyzed  provided insights into various processes in place to produce FISMA  reports. We also conducted interviews with agency officials at OMB, DHS,  NIST, and the six selected agencies. For the six agencies, we collected  data from inspectors general and agency officials. Based on this  assessment, we determined that the data were sufficiently reliable for our  work.
We conducted this performance audit from December 2014 to September  2015 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. For more details on our  objectives, scope, and methodology, see appendix I.
subsections: section_title: Background
paragraphs: To help protect against threats to federal systems, FISMA 2002 set forth  a comprehensive framework for ensuring the effectiveness of information  security controls over information resources that support federal  operations and assets. This framework created a cycle of risk  management activities necessary for an effective security program. It was  also intended to provide a mechanism for improved oversight of federal  agency information security programs. To ensure the implementation of  this framework, FISMA 2002 assigned specific responsibilities to  agencies, their inspectors general, OMB, and NIST.
FISMA 2002 required each agency in the executive branch to develop,  document, and implement an information security program that includes  the following components: periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems; policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements;  subordinate plans for providing adequate information security for  networks, facilities, and systems or a group of information systems, as  appropriate;  security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies  and procedures, as well as training personnel with significant security  responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems; a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security  incidents; and plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency.
In addition, each of the agencies in the executive branch were to report  annually to OMB, certain congressional committees, and the Comptroller  General on the adequacy and effectiveness of information security  policies, procedures, and practices, and their compliance with the act.  FISMA 2002 also required each agency inspector general, or other  independent auditor, to annually evaluate and report on the information  security program and practices of the agency.
OMB’s responsibilities included developing and overseeing the  implementation of policies, principles, standards, and guidelines on  information security in federal agencies except with regard to national  security systems. FISMA 2002 also assigned responsibility to OMB for  ensuring the operation of a federal information security incident center.  The required functions of this center are performed by DHS’s United  States Computer Emergency Readiness Team (US-CERT), which was  established to aggregate and disseminate cybersecurity information to  improve warning and response to incidents, increase coordination of  response information, reduce vulnerabilities, and enhance prevention and  protection. OMB is also responsible for reviewing, at least annually, and  approving or disapproving agencies’ information security programs.
Since it began issuing guidance to agencies in 2003, OMB has instructed  agency chief information officers and inspectors general to report on a  variety of metrics in order to satisfy reporting requirements established by  FISMA 2002. Over time, these metrics have evolved to include  administration priorities and baseline metrics meant to allow for  measurement of agency progress in implementing information security- related priorities and controls. OMB requires agencies and inspectors  general to use an interactive data collection tool called CyberScope to  respond to these metrics. The metrics are used by OMB to summarize  agencies’ progress in meeting FISMA 2002 requirements and report this  progress to Congress in an annual report, as required by FISMA 2002.
NIST’s responsibilities under FISMA 2002 included the development of  security standards and guidelines for agencies that include standards for  categorizing information and information systems according to ranges of  impact-levels (See Federal Information Processing Standards 199 and  200), minimum security requirements for information and information  systems in risk categories, guidelines for detection and handling of  information security incidents, and guidelines for identifying an  information system as a national security system.
During the 12 years FISMA 2002 was enacted into law and then largely  replaced by FISMA 2014, executive branch oversight of agency  information security has evolved. As part of its FISMA 2002 oversight  responsibilities, OMB has issued annual instructions for agencies and  inspectors general to meet FISMA 2002 reporting requirements. In July  2010, the Director of OMB and the White House Cybersecurity  Coordinator issued a joint memorandum that gave DHS primary  responsibility within the executive branch for the operational aspects of  cybersecurity for federal information systems that fall within the scope of  FISMA 2002. This memo stated that DHS would have these five  responsibilities: overseeing implementation of and reporting on government  cybersecurity policies and guidance; overseeing and assisting government efforts to provide adequate,  risk-based, and cost-effective cybersecurity; overseeing agencies’ compliance with FISMA 2002; overseeing agencies’ cybersecurity operations and incident response; annually reviewing agencies’ cybersecurity programs.
The OMB memo further stated that, in carrying out these responsibilities,  DHS was to be subject to general OMB oversight in accordance with the  provisions of FISMA 2002. In addition, the Cybersecurity Coordinator  would lead the interagency process for cybersecurity strategy and policy  development.
In accordance with guidance contained in the memo, DHS, instead of  OMB, issued guidance to agencies and inspectors general on metrics  used for reporting agency performance of cybersecurity activities and  privacy requirements, while OMB continued to provide more general  reporting guidance. Specifically, DHS provided guidance to agencies for  reporting on the implementation of security requirements in areas such as  continuous monitoring, configuration management, incident response,  security training, and contingency planning, among others. The guidance  also instructs inspectors general on reporting the results of their annual  evaluations and instructs senior agency officials for privacy on reporting  their agencies’ implementation of privacy requirements.
As previously mentioned, DHS is also responsible for ensuring the  operation of a federal information security incident center to improve  warning and response to incidents, increase coordination of response  information, reduce vulnerabilities, and enhance prevention and  protection. Within DHS, the Federal Network Resilience division’s  Cybersecurity Performance Management Branch is responsible for (1)  developing and disseminating FISMA 2002 reporting metrics, (2)  managing the CyberScope web-based application, and (3) collecting and  reviewing federal agencies’ cybersecurity data submissions and monthly  data feeds to CyberScope. In addition, the Cybersecurity Assurance  Program Branch is responsible for conducting cybersecurity reviews and  assessments at federal agencies to evaluate the effectiveness of  agencies’ information security programs.
subsections: section_title: New FISMA Requirements Clarify Roles and Responsibilities
paragraphs: To further improve cybersecurity and clarify oversight responsibilities,  Congress passed FISMA 2014. FISMA 2014 is intended to address the  increasing sophistication of cybersecurity attacks, promote the use of  automated security tools with the ability to continuously monitor and  diagnose the security posture of federal agencies, and provide for  improved oversight of federal agencies’ information security programs.  Specifically, the act clarifies and assigns additional responsibilities to  OMB, DHS, and federal agencies in the executive branch. These new  responsibilities include:
Preserves OMB’s oversight responsibilities, but removes the  requirement for OMB to annually review and approve agencies’  information security programs.
Requires OMB to include in its annual report to Congress a summary  of major agency information security incidents, an assessment of  agency compliance with NIST standards, and an assessment of  agency compliance with breach notification requirements. For two  years after enactment, OMB is to include in its annual report an  assessment of agencies’ adoption of continuous diagnostic  technologies and other advanced security tools.
Requires OMB to update data breach notification policies and  guidelines periodically and require notice to congressional committees  and affected individuals.
Expands exemptions from OMB oversight for certain national security- related systems.
States that OMB shall, in consultation with DHS, the Chief Information  Officers Council, the Council of Inspectors General on Integrity and  Efficiency, and other interested parties as appropriate, ensure the  development of guidance for evaluating the effectiveness of an  information security program and practices.
Establishes DHS responsibility, in consultation with OMB, to  administer the implementation of agency information security policies  and practices for information systems other than national security  systems, the Department of Defense, and the Intelligence  community’s “debilitating impact” systems.
Requires DHS to develop, issue, and oversee implementation of  binding operational directives to agencies. Such directives include  those for incident reporting, contents of annual agency reports, and  other operational requirements.
Gives DHS responsibility to operate the federal information security  incident center, deploy technology to continuously diagnose and  mitigate threats, compile and analyze data, and develop and conduct  targeted operational evaluations, including threat and vulnerability  assessments of systems.
Requires agencies to comply with DHS operational directives in  addition to OMB policies and procedures and NIST standards.
Requires agencies to ensure that senior officials carry out assigned  responsibilities and that all personnel are held accountable for  complying with the agency’s information security program.
Requires agencies to use automated tools in periodic testing and  evaluation of the effectiveness of information security policies,  procedures, and practices.
Requires agencies to report major security incidents to Congress  within 7 days. Agencies are also to include a description of major  incidents in their annual report to Congress.
FISMA 2014 also requires that the annual independent evaluation  include an assessment of the effectiveness of the information security  policies, procedures, and practices of the agency. This replaces the  previous FISMA 2002 requirement that the independent annual  evaluation include an assessment of agency compliance with the  requirements of the act and related policies, procedures, standards,  and guidelines.
In addition, FISMA 2014 reiterates the previous requirement for federal  agencies to develop, document, and implement an agency-wide  information security program. Each agency and its Office of Inspector  General are still required to report annually to OMB, selected  congressional committees, and the Comptroller General on the adequacy  of the agency’s information security policies, procedures, practices, and  compliance with requirements.
section_title: Continued Weaknesses Place Federal Agencies’ Information and Information Systems at Risk
paragraphs: During fiscal years 2013 and 2014, federal agencies continued to  experience weaknesses in protecting their information and information  systems. These systems remain at risk as illustrated in part by the  evolving array of cyber-based threats and the increasing numbers of  incidents reported by federal agencies. (See app. II for additional  information on cyber threats and exploits.) At the same time, weaknesses  in their information security policies and practices hinder their efforts to  protect against threats. Furthermore, our work and reviews by inspectors  general highlight information security control deficiencies at agencies that  expose information and information systems supporting federal  operations and assets to elevated risk of unauthorized use, disclosure,  modification, and disruption. Accordingly, we and agency inspectors  general have made hundreds of recommendations to agencies to address  these security control deficiencies.
subsections: section_title: Number of Incidents Reported by Federal Agencies Continues to Increase
paragraphs: The number of information security incidents affecting systems supporting  the federal government has continued to increase. Since fiscal year 2006,  the number rose from 5,503 to 67,168 in fiscal year 2014: an increase of  1,121 percent. Figure 1 illustrates the increasing number of security  incidents at federal agencies from 2006 through 2014.
Similarly, the number of information security incidents involving PII  reported by federal agencies has more than doubled in recent years, from  10,481 in 2009 to 27,624 in 2014.
Of the incidents occurring in 2014 (not including those reported as non- cyber incidents) scans/probes/attempted access was the most widely  reported type of incident across the federal government. This type of  incident can involve identifying a federal agency computer, open ports,  protocols, service, or any combination of these for later exploit. As shown  in figure 2, these incidents represented 19 percent of the various  incidents reported to US-CERT in fiscal year 2014.
These incidents and others like them can pose a serious challenge to  economic, national, and personal privacy and security. Recent examples  highlight the impact of such incidents:  In June 2015, OPM reported that an intrusion into its systems affected  the personnel records of about 4.2 million current and former federal  employees. The Director of OPM also stated that a separate but  related incident affected background investigation files and  compromised OPM systems related to background investigations for  21.5 million individuals.
In June 2015, the Commissioner of the Internal Revenue Service  testified that unauthorized third parties had gained access to taxpayer  information from its “Get Transcript” application. According to officials,  criminals used taxpayer-specific data acquired from non-department  sources to gain unauthorized access to information on approximately  100,000 tax accounts. These data included Social Security  information, dates of birth, and street addresses. In an August 2015  update, the Internal Revenue Service reported this number to be  about 114,000, and that an additional 220,000 accounts had been  inappropriately accessed, which brings the total to about 330,000  accounts.
In April 2015, the Department of Veterans Affairs’ Office of Inspector  General reported that two contractors had improperly accessed the  agency’s network from foreign countries using personally owned  equipment.
In February 2015, the Director of National Intelligence stated that  unauthorized computer intrusions were detected in 2014 on the  networks of the Office of Personnel Management and two of its  contractors. The two contractors were involved in processing sensitive  PII related to national security clearances for federal employees.
In September 2014, a cyber intrusion into the United States Postal  Service’s information systems may have compromised PII for more  than 800,000 of its employees.
In October 2013, a wide-scale cybersecurity breach involving a U.S.  Food and Drug Administration system occurred that exposed the PII  of 14,000 user accounts.
section_title: Cybersecurity Deficiencies Continue to Place Systems at Risk
paragraphs: Our work at federal agencies continues to highlight information security  deficiencies in both financial and nonfinancial systems. We have made  hundreds of recommendations to agencies to address these security  control deficiencies, but many have not yet been fully implemented. The  following examples describe the risks we found at federal agencies, our  recommendations, and the agencies’ responses to our recommended  actions.
In March 2015, we reported that the Internal Revenue Service had not  installed appropriate security updates on all of its databases and  servers, and had not sufficiently monitored control activities that  support its financial reporting and protect taxpayer data. Also, the  agency had not effectively maintained secure settings or separation of  duties by allowing a developer unnecessary access to a key  application. In addition to 51 recommendations made in prior years  that remain unimplemented, we made 19 additional recommendations  to help the agency more effectively implement elements of its  information security program and address newly identified control  weaknesses. The Internal Revenue Service agreed to develop  corrective action plans, as appropriate, to address these  recommendations.
In January 2015, we reported that the Federal Aviation Administration  had significant security control weaknesses in the five air traffic  control systems we reviewed. These systems perform functions such  as determining and sharing precise aircraft location, streaming flight  information to cockpits of aircraft, providing telecommunications  infrastructure for NextGen, and are necessary for ensuring the safe  and uninterrupted operation of the national airspace system. We  identified numerous weaknesses in controls intended to prevent, limit,  and detect unauthorized access to computer resources, such as  controls for protecting system boundaries, identifying and  authenticating users, authorizing users to access systems, encrypting  sensitive data, and auditing and monitoring activity on its systems.  The agency also had not fully implemented an agency-wide  information security program, in part due to not having fully  established an integrated, organization-wide approach to managing  information security risk. We made 168 recommendations to the  agency to mitigate control deficiencies and 17 recommendations to  fully implement its information security program and establish an  integrated approach to managing information security risk. The  Federal Aviation Administration concurred with our recommendations,  described actions that it was taking to improve its information security,  and indicated that it would address the recommendations.
In November 2014, we reported that the Department of Veterans  Affairs had not taken effective actions to contain and eradicate a  significant incident detected in 2012 involving a network intrusion.  Further, the department’s actions to address vulnerabilities identified  in two key web applications were insufficient. Additionally,  vulnerabilities identified in workstations (e.g., laptop computers) had  not been corrected. We made eight recommendations to address  identified weaknesses in incident response, web applications, and  patch management. The department concurred with our  recommendations and provided an action plan for addressing the  identified weaknesses.
Similar to our work, independent reviews at the 24 agencies continued to  highlight deficiencies in their implementation of information security  policies and procedures. Specifically, for fiscal year 2014, 19 agencies  reported that information security control deficiencies were either a  material weakness or a significant deficiency in internal controls over their  financial reporting. This reflected an increase from fiscal year 2013,  when 18 agencies reported that information security control deficiencies  were either a material weakness or a significant deficiency in internal  controls over their financial reporting. Further, 23 of 24 inspectors general  for the agencies cited information security as a “major management  challenge” for their agency, reflecting an increase from fiscal year 2013,  when 21 inspectors general cited information security as a major  challenge. The inspectors general made numerous recommendations to  address these issues, as discussed later in this report.
section_title: Agencies Exhibited Weaknesses in All Major Categories of Controls
paragraphs: Our reports, agency reports, and inspectors general assessments of  information security controls during fiscal years 2013 and 2014 revealed  that most of the 24 agencies had weaknesses in each of the five major  categories of information system controls: (1) access controls, which limit  or detect access to computer resources (data, programs, equipment, and  facilities), thereby protecting them against unauthorized modification,  loss, and disclosure; (2) configuration management controls, intended to  prevent unauthorized changes to information system resources (for  example, software programs and hardware configurations) and assure  that software is current and known vulnerabilities are patched; (3)  segregation of duties, which prevents a single individual from controlling  all critical stages of a process by splitting responsibilities between two or  more organizational groups; (4) contingency planning, which helps avoid  significant disruptions in computer-dependent operations; and (5)  agencywide security management, which provides a framework for  ensuring that risks are understood and that effective controls are  selected, implemented, and operating as intended.
While the number of agencies exhibiting weaknesses decreased slightly  in two of five categories, deficiencies were prevalent for the majority of  them, as shown in figure 3.
In the following subsections, we discuss the specific information security  weaknesses agencies reported for fiscal years 2013 and 2014.
subsections: section_title: Most Agencies Had Weaknesses in Access Controls
paragraphs: Agencies use electronic and physical controls to limit, prevent, or detect  inappropriate access to computer resources (data, equipment, and  facilities), thereby protecting them from unauthorized use, modification,  disclosure, and loss. Access controls involve the six critical elements  described in table 1.
For fiscal years 2013 and 2014, we, agencies, and inspectors general  reported weaknesses in access controls for 22 of the 24 agencies. In  fiscal year 2014, 12 agencies had weaknesses reported in protecting their  networks and system boundaries, a reduction from the 17 agencies that  had weaknesses in fiscal year 2013. For example, we found that 1  agency component’s access control lists on a firewall had not prevented  traffic coming or initiated from the public internet protocol addresses of a  contractor site and a U.S. telecom corporation from entering to its  network. Additionally, for fiscal year 2014, 20 agencies had weaknesses  reported in their ability to appropriately identify and authenticate system  users, a slight increase from 19 of 24 in fiscal year 2013. To illustrate, in  fiscal year 2014, 1 agency had not consistently applied proper password  settings to mainframe service accounts, where those accounts were  configured to never require password changes. Agencies also had weak  password controls, such as using system passwords that had not been  changed from the easily guessable default passwords.
In fiscal year 2014, 18 agencies had weaknesses reported in  authorization controls, a reduction from the 20 agencies that had  weaknesses in fiscal year 2013. One example of this weakness for fiscal  year 2014 was that 1 agency had not consistently or in a timely manner  removed, transferred, and/or terminated employee and contractor access  privileges from multiple systems. Another agency had granted access  privileges unnecessarily, which allowed users of an internal network to  read and write files containing sensitive system information, including  passwords, that were used to support automated data transfer operations  between numerous systems. In fiscal year 2014, 4 agencies had  weaknesses reported in encryption, down from 7 in fiscal year 2013.
In addition, 19 agencies had weaknesses reported in implementing an  effective audit and monitoring capability. For instance, 1 agency had not  effectively implemented audit and monitoring controls on a system where  the servers and network devices were not sufficiently logging security- relevant events. Finally, 10 agencies had weaknesses reported in their  ability to restrict physical access or harm to computer resources and  protect them from unauthorized loss or impairment. For example, a  contractor of an agency was granted physical access to a server room  without the required approval of the office director. Without adequate  access controls in place, agencies cannot ensure that their information  resources are being protected from intentional or unintentional harm.
section_title: Agencies Did Not Fully Implement Controls for Configuration Management
paragraphs: Configuration management controls ensure that only authorized and fully  tested software is placed in operation, software and hardware is updated,  information systems are monitored, patches are applied to these systems  to protect against known vulnerabilities, and emergency changes are  documented and approved. These controls, which limit and monitor  access to powerful programs and sensitive files associated with computer  operations, are important in providing reasonable assurance that access  controls and the operations of systems and networks are not  compromised. To protect against known vulnerabilities, effective  procedures must be in place, current versions of vendor-supported  software installed, and patches promptly implemented. Up-to-date patch  installation helps mitigate known flaws in software code that could be  exploited to cause significant damage and enable malicious individuals to  read, modify, or delete sensitive information or disrupt operations.
In fiscal year 2014, 22 agencies had weaknesses reported in  configuration management, a reduction from the 24 agencies that had  weaknesses in fiscal year 2013. For fiscal year 2014, 17 agencies had  weaknesses reported with installing software patches and implementing  current versions of software in a timely manner, an improvement from the  23 reported in fiscal year 2013. One agency had not installed critical  updates in a timely manner for several of its servers. Another agency was  using an unsupported software application on its workstations, and a  database system used to support the access authorization system was no  longer supported. For fiscal year 2014, 14 agencies had weaknesses  reported in authorizing, testing, approving, tracking, and controlling  configuration changes. In fiscal year 2014, our work revealed that 1  agency had not effectively documented and approved configuration  changes. Specifically, the agency did not request or approve 32 changes  to mainframe production processing that had been recorded in the system  logs.
Without a consistent approach to testing, updating, and patching  software, agencies increase their risk of exposing sensitive data to  unauthorized and possibly undetected access.
section_title: More than Half of the Agencies Did Not Segregate Incompatible Duties
paragraphs: Segregation of duties refers to the policies, procedures, and  organizational structure that help to ensure that one individual cannot  independently control all key aspects of a computer-related operation and  thereby take unauthorized actions or gain unauthorized access to assets  or records. Key steps to achieving proper segregation are ensuring that  incompatible duties are separated and employees understand their  responsibilities, and controlling personnel activities through formal  operating procedures, supervision, and review.
In fiscal years 2013 and 2014, 15 agencies had weaknesses reported in  implementing segregation of duties controls. For example, in fiscal year  2014, 1 agency had not implemented requirements for separating  incompatible duties. Additionally, a developer from another agency had  been authorized inappropriate access to the production environment of  the agency’s system. Further, another agency had not adequately  implemented segregation of duties controls for IT and financial  management personnel with access to financial systems across several  platforms and environments.
Without adequate segregation of duties, agencies increase the risk that  erroneous or fraudulent actions will occur, improper program changes will  be implemented, and computer resources will be damaged or destroyed.
section_title: Agencies Had Weaknesses in Continuity of Operations
paragraphs: In the event of an act of nature, fire, accident, sabotage, or other  disruption, an essential element in preparing for the loss of operational  capabilities is having an up-to-date, detailed, and fully tested continuity of  operations plan. This plan should cover all key functions, including  assessing an agency’s information technology and identifying resources,  minimizing potential damage and interruption, developing and  documenting the plan, and testing it and making necessary adjustments.  If continuity of operations controls are faulty, even relatively minor  interruptions can result in lost or incorrectly processed data, which can  lead to financial losses, expensive recovery efforts, and inaccurate or  incomplete mission-critical information.
Eighteen agencies had weaknesses reported in continuity of operations  practices for their agencies in fiscal years 2014 and 2013. Specifically, in  2014, 16 agencies did not have a comprehensive contingency plan. For  example, 1 agency’s contingency plans had not been updated to reflect  changes in the system boundaries, roles and responsibilities, and lessons  learned from testing contingency plans at alternate processing and  storage sites. Additionally, 15 agencies had not regularly tested their  contingency plans. For example, 1 agency had not annually tested  contingency plans for 10 of its 16 systems.
Until agencies address identified weaknesses in their continuity of  operations plans and tests of these plans, they may not be able to  recover their systems in a successful and timely manner when service  disruptions occur.
section_title: Agencies Did Not Effectively Manage Security
paragraphs: An underlying cause for information security weaknesses identified at  federal agencies is that they have not yet fully or effectively implemented  an agency-wide information security program to help them manage their  security process. An agency-wide security program, as required by  FISMA 2002, provides a framework for assessing and managing risk,  including developing and implementing security policies and procedures,  conducting security awareness training, monitoring the adequacy of the  entity’s computer-related controls through security tests and evaluations,  and implementing remedial actions as appropriate. Without a well- designed program, security controls may be inadequate; responsibilities  may be unclear, misunderstood, and improperly implemented; and  controls may be inconsistently applied. Such conditions may lead to  insufficient protection of sensitive or critical resources.
In fiscal year 2014, 23 agencies had weaknesses reported in security  management, while 24 had them in fiscal year 2013. In one example, an  agency had not fully developed and implemented components of its  agency-wide information security risk management program that met  FISMA’s requirements. Specifically, the agency had established an  enterprise risk management framework; however, security risks had not  been fully communicated to data centers, regional offices, and medical  facilities. In another example, the agency did not have effective  procedures for testing and evaluating controls since the procedures did  not prescribe effective tests of authentication controls.
Until agencies fully resolve identified deficiencies in their agency-wide  information security programs, they will continue to face significant  challenges in protecting their information and systems.
section_title: We and Inspectors General Recommended Actions to Strengthen Information Security
paragraphs: Over the last several years, we and agency inspectors general have  made hundreds of recommendations to agencies aimed at improving their  implementation of information security controls. These recommendations  identify actions for agencies to take in protecting their information and  systems. For example, we and inspectors general have made  recommendations for agencies to correct weaknesses in controls  intended to prevent, limit, and detect unauthorized access to computer  resources, such as controls for protecting system boundaries, identifying  and authenticating users, authorizing users to access systems, encrypting  sensitive data, and auditing and monitoring activity on their systems. We  have also made recommendations for agencies to implement their  information security programs and protect the privacy of PII held on their  systems.
However, many agencies continue to have weaknesses in implementing  these controls in part because many of these recommendations remain  unimplemented. Until federal agencies take actions to implement the  recommendations made by us and the inspectors general, federal  systems and information as well as sensitive personal information about  the public will be at an increased risk of compromise from cyber-based  attacks and other threats.
section_title: Federal Efforts Are Underway to Improve Security
paragraphs: Due to the increase in cyber security threats, the federal government has  initiated or continued several efforts to protect federal information and  information systems. The White House, OMB, and federal agencies have  launched several government-wide efforts that are intended to enhance  information security at federal agencies. These key efforts are discussed  here.
Cybersecurity Cross-Agency Priority goals: Initiated in 2012, the  cybersecurity Cross-Agency Priority (CAP) goals are an effort intended to  focus federal agencies’ cybersecurity activity on the most effective  controls. For fiscal years 2013 and 2014, these goals included:
Trusted Internet Connections: Trusted Internet Connections (TIC)  aims to improve the federal government’s security posture through the  consolidation of external telecommunication connections by  establishing a set of baseline security capabilities through enhanced  monitoring and situational awareness of all external network  connections. OMB established fiscal year 2014 targets of 95 percent  for TIC consolidation and 100 percent for implementing TIC  capabilities. OMB reported that agencies had achieved 95 and 92  percent implementation, respectively, for these TIC goals in fiscal year  2014.
Continuous monitoring: Intended to provide near real-time security  status and remediation, increasing visibility into system operations  and helping security personnel make risk management decisions  based on increased situational awareness. OMB established a fiscal  year 2014 target of 95 percent implementation for continuous  monitoring and reported that the agencies had achieved 92 percent  implementation.
Strong authentication: Intended to increase the use of federal  smartcard credentials, such as personal identity verification and  common access cards that provide multifactor authentication and  digital signature and encryption capabilities. Strong authentication can  provide a higher level of assurance when authorizing users’ access to  federal information systems. OMB established a fiscal year 2014  target of 75 percent implementation for strong authentication. In its  report on fiscal year 2014 FISMA implementation, OMB indicated that  the 24 federal agencies covered by the CFO Act had achieved a  combined 72 percent implementation of these requirements, but this  number dropped to only 41 percent implementation for the 23 civilian  agencies when excluding DOD.
In fiscal year 2015, the administration added the anti-phishing and  malware defense as a new goal for the CAP initiative.
The National Cybersecurity Protection System (NCPS): NCPS is a  system of systems (also known as EINSTEIN) that is intended to deliver a  range of capabilities including intrusion detection and prevention,  analytics, and information sharing. The goal of EINSTEIN is to provide the  federal government with an early warning system, improved situational  awareness of intrusion threats, near real-time identification, and  prevention of malicious cyber activity. This system was created in 2003  by US-CERT to help reduce and prevent computer network vulnerabilities  across the federal government. The capabilities of NCPS are to include  network “flow,” intrusion detection, and intrusion prevention functions, as  described in table 2.
The Continuous Diagnostics and Mitigation (CDM) Program: CDM is  intended to provide federal departments and agencies with a basic set of  tools to support the continuous monitoring of information systems.  According to DHS, the program is intended to provide federal  departments and agencies with capabilities and tools that identify  cybersecurity risks on an ongoing basis, prioritize these risks based on  potential impacts, and enable cybersecurity personnel to mitigate the  most significant problems first. These tools include sensors that perform  automated searches for known cyber vulnerabilities, the results of which  feed into a dashboard that alerts network managers. These alerts can be  prioritized, enabling agencies to allocate resources based on risk. DHS, in  partnership with the General Services Administration, has established a  government-wide acquisition vehicle to allow federal agencies (as well as  state, local, and tribal governmental agencies) to acquire CDM tools at  discounted rates.
The National Initiative for Cybersecurity Education (NICE): NICE is  an interagency effort coordinated by NIST to improve cybersecurity  education, including efforts directed at training, public awareness, and the  federal cybersecurity workforce. This initiative is intended to support the  federal government’s evolving strategy for education, awareness, and  workforce planning and provide a comprehensive cybersecurity education  program. To meet NICE objectives, efforts were structured into the  following four components:  1.  National cybersecurity awareness: This component included public  service campaigns to promote cybersecurity and responsible use of  the Internet and to make cybersecurity popular for children. It was  also aimed at making cybersecurity a popular educational and career  pursuit for older students.  2.  Formal cybersecurity education: Education programs  encompassing K-12, higher education, and vocational programs  related to cybersecurity were included in this component, which  focused on the science, technology, engineering, and math disciplines  to provide a pipeline of skilled workers for private sector and  government.  3.  Federal cybersecurity workforce structure: This component  addressed personnel management functions, including the definition  of cybersecurity jobs in the federal government and the skills and  competencies they required. Also included were new strategies to  ensure federal agencies can attract, recruit, and retain skilled  employees to accomplish cybersecurity missions.  4.  Cybersecurity workforce training and professional development:  Cybersecurity training and professional development for federal  government civilian, military, and contractor personnel were included  in this component.
The Federal Risk and Authorization Management Program  (FedRAMP): FedRAMP is a government-wide program intended to  provide a standardized approach to security assessment, authorization,  and continuous monitoring for cloud computing products and services.
FedRAMP defines a set of controls for low and moderate impact-level  systems according to the baseline controls in NIST SP 800-53 Revision  4 and includes control enhancements related to the unique security  requirements of cloud computing. All federal agencies must meet  FedRAMP requirements when using cloud services and the cloud service  providers must implement the FedRAMP security requirements in their  cloud environment.
In addition, the cloud service providers must hire a FedRAMP-approved  third-party assessment organization to perform an independent  assessment to audit the cloud system and provide a security assessment  package for review. The package will then be reviewed by the FedRAMP  Joint Authorization Board, which may grant a provisional authorization.  Federal agencies can leverage cloud service provider authorization  packages for review when granting an agency authority to operate, where  this reuse is intended to save time and money. After the cloud provider  has received a FedRAMP authorization from the Joint Authorization  Board or the agency, it must implement a continuous monitoring  capability to ensure the cloud system maintains an acceptable risk  posture.
The Cyber and National Security Team (E-Gov Cyber): OMB created  the Cyber and National Security Team, called the E-Gov Cyber Unit, to  strengthen federal cybersecurity through targeted oversight and policy  issuance. The unit and its partners, the National Security Council, DHS,  and NIST, are to oversee agency and government-wide cybersecurity  programs, and oversee and coordinate the federal response to major  cyber incidents and vulnerabilities. OMB reported that the unit found that  more than half of incidents occurring at federal agencies could have been  prevented by strong authentication. In addition, the unit intends to monitor  implementation of critical DHS programs such as NCPS and CDM.
The 30-Day Cybersecurity Sprint: In June 2015, in response to the  OPM security breaches and to improve federal cybersecurity and protect  systems against evolving threats, the Federal Chief Information Officer  launched the 30-day Cybersecurity Sprint. As part of this effort, the  Federal Chief Information Officer instructed federal agencies to  immediately take a number of steps to further protect federal information  and assets and to improve the resilience of federal networks. Specifically,  federal agencies were to:  Immediately deploy indicators provided by DHS regarding priority  threat actor techniques, tactics, and procedures to scan systems and  check logs. Agencies were to inform DHS immediately if indicators  return evidence of malicious cyber activity.
Patch critical vulnerabilities without delay. The vast majority of cyber  intrusions exploit well-known vulnerabilities that are easy to identify  and correct. Agencies were to take immediate action on the DHS  vulnerability scan reports they receive each week and report to OMB  and DHS on progress and challenges within 30 days.
Tighten policies and practices for privileged users. To the greatest  extent possible, agencies were to minimize the number of privileged  users; limit functions that can be performed when using privileged  accounts; limit the duration that privileged users can be logged in; limit  the privileged functions that can be performed using remote access;  and ensure that privileged user activities are logged and that such  logs are reviewed regularly. Agencies were to report to OMB and DHS  on progress and challenges within 30 days.
Dramatically accelerate implementation of multi-factor authentication,  especially for privileged users. Intruders can easily steal or guess  usernames/passwords and use them to gain access to federal  networks, systems, and data. Requiring the use of a personal identity  verification card or alternative form of multi-factor authentication can  significantly reduce the risk of adversaries penetrating federal  networks and systems. Agencies were to report to OMB and DHS on  progress and challenges in implementation of these enhanced  security requirements within 30 days.
In addition to providing guidance to the agencies, the Federal Chief  Information Officer established the Cybersecurity Sprint Team to lead  a review of the federal government’s cybersecurity policies,  procedures, and practices. According to OMB, the team is comprised  of OMB’s E-Gov Cyber and National Security Unit, the National  Security Council Cybersecurity Directorate, DHS, and DOD. At the  end of the review, the Federal Chief Information Officer is to create  and operationalize a set of action plans and strategies to further  address critical cybersecurity priorities and recommend a federal  civilian cybersecurity strategy. Key principles of the strategy are to  include:
Protecting data: Better protect data at rest and in transit.
Improving situational awareness: Improve indication and  warning.  Increasing cybersecurity proficiency: Ensure a robust capacity  to recruit and retain cybersecurity personnel.  Increasing awareness: Improve overall risk awareness by all  users.
Standardizing and automating processes: Decrease time  needed to manage configurations and patch vulnerabilities.
Controlling, containing, and recovering from incidents:  Contain malware proliferation, privilege escalation, and lateral  movement. Quickly identify and resolve events and incidents.
Strengthening systems Life-cycle security: Increase inherent  security of platforms by buying more secure systems and retiring  legacy systems in a timely manner.
Reducing attack surfaces: Decrease complexity and number of  things defenders need to protect.
Successful implementation of these government-wide efforts will be key  steps to improving cybersecurity at federal agencies.
section_title: Agencies’ Implementation of FISMA 2002 Requirements Was Mixed
paragraphs: The extent of agencies’ implementation of FISMA 2002 requirements for  establishing and maintaining an information security program from fiscal  year 2013 to fiscal year 2014 varied. For example, according to the  reports by the inspectors general of the 24 CFO Act agencies, the  number of agencies implementing risk management activities and  documenting policies and procedures increased while the number of  agencies planning for security, providing security training, and testing  controls decreased. In addition, agency inspectors general, NIST, and  OMB, with support from DHS, continued to address their responsibilities  under FISMA 2002, but opportunities remain for improving FISMA  reporting.
subsections: section_title: More Agencies Implemented Risk Management Activities
paragraphs: FISMA 2002 required that agencies periodically assess the risk and  magnitude of harm that could result from the unauthorized access, use,  disclosure, disruption, modification, or destruction of information or  information systems. These risk assessments help determine whether  controls are in place to remediate or mitigate risk to the agency. NIST has  issued several guides for managing risk.
According to NIST’s Guide for Applying the Risk Management Framework  to Federal Information Systems, risk management is addressed at the  organization level, the mission and business process level, and the  information system level. Risks are addressed from an organizational  perspective with the development of, among other things, risk  management policies, procedures, and strategy. The risk decisions made  at the organizational level are to guide the entire risk management  program. In addition, the activities for the risks that are addressed at the  mission and business process levels include, among other things,  defining and prioritizing the agency’s mission and business processes  and developing an organization-wide information protection strategy.  There are various risk management activities for the risks that are  addressed at the information system level, including categorizing  organizational information systems, allocating security controls to  organizational information systems, and managing the selection,  implementation, assessment, authorization, and ongoing monitoring of  security controls.
For fiscal years 2014 and 2013, inspectors general reported that 12  agencies had addressed risk from an organization perspective. In fiscal  year 2014, inspectors general reported that 16 of 24 agencies had  addressed risk from a mission or business perspective compared to 14 in  fiscal year 2013. According to inspectors general, for fiscal years 2013  and 2014, 16 agencies had addressed risk from an information system  perspective. Figure 4 shows examples of agencies’ implementation of risk  management program elements for fiscal years 2013 and 2014.
However, work by the inspectors general revealed weaknesses in risk  management. According to OMB, inspectors general at seven agencies  reported that their agency did not have a risk management program in  place. The inspector general for one agency reported that, although the  agency had implemented a risk governance structure, it had not fully  identified or mitigated the enterprise-wide risks with appropriate risk  mitigation strategies. Another inspector general reported that its agency  did not have a current risk assessment for three of the seven systems in  the sample. Managing risk is the center of an effective information  security program; without effective risk management, agencies may not  be fully aware of the risks to essential computing resources and may not  be able to make informed decisions about needed security protections.
section_title: Most Agencies Had Documented Policies and Procedures
paragraphs: FISMA 2002 required agencies to develop, document, and implement  policies and procedures that are based on risk assessments; cost-effectively reduce information security risks to an acceptable  level; ensure that information security is addressed throughout the life cycle  of each agency’s information system; and ensure compliance with FISMA 2002 requirements, OMB policies and  procedures, minimally acceptable system configuration requirements,  and any other applicable requirements.
In fiscal years 2014 and 2013, most agency inspectors general reported  that their agency had documented policies and procedures that were  consistent with federal guidelines and requirements. Specifically, the  number of agencies that documented policies and procedures increased  in 8 of 11 categories, and remained the same in 3 categories since one  inspector general did not report on these. Table 3 summarizes agencies’  performance for fiscal years 2013 and 2014.
In our prior work, we have also identified weakness in agencies policies  and procedures for information security. In fiscal year 2014, we reported  that six agencies we reviewed had not fully developed comprehensive  policies and procedures for incident response. For example, only two of  the six selected agencies had fully implemented policies that addressed  roles, responsibilities, and levels of authority for incident response.  Similarly, we reported that several agencies had not established policies  and procedures to oversee or assess the security of contractor systems.  Further, we found that one agency component’s mainframe security  policy did not address who can administer the security software  configurations that control access to mainframe programs. We  recommended that these agencies develop and update policies and  procedures for these areas. The agencies generally concurred with our  recommendations.
Until all agencies properly document and implement policies and  procedures, they may not be able to effectively reduce risks to their  information and information systems, and the information security  practices that are driven by these policies and procedures may be applied  inconsistently.
section_title: Number of Agencies with Sufficient Security Planning Decreased
paragraphs: FISMA 2002 required agencies’ information security programs to include  plans for providing adequate information security for networks, facilities,  and systems or groups of information systems, as appropriate. According  to NIST, the purpose of a system security plan is to provide an overview  of the security requirements of the system and describe the controls in  place or planned for meeting those requirements. The first step in the  system security planning process is to categorize the system based on  the impact to agency operations, assets, and personnel should the  confidentiality, integrity, and availability of the agency’s information and  information systems be compromised. This categorization is then used to  determine the appropriate security controls needed for each system.  Another key step is selecting a baseline of security controls for each  system and documenting those controls in the security plan.
In addition, NIST recommends that the plan be reviewed and updated at  least annually. According to NIST, the security authorization package  documents the results of the security control assessment and provides  the authorizing official with essential information needed to make a risk- based decision on whether to authorize operation of an information  system or a designated set of common controls. The package contains a  security plan, security assessment report, and plan of action and  milestones (POA&M). DHS’s fiscal year 2014 reporting instructions  request inspectors general to report on their agencies implementation of  certain program attributes such as whether (1) the agency has  categorized information systems, (2) its security authorization package  contained system security plan, security assessment report, POA&M, and  accreditation boundaries, and (3) it has selected and implemented a  tailored set of baseline security controls.
In fiscal year 2014, agency inspectors general at 18 agencies reported  that their agency had categorized information systems in accordance with  federal policies, a decrease from fiscal year 2013, in which 19 inspectors  general reported that their agency had categorized their systems. In  addition, fewer agencies selected an appropriately tailored set of baseline  security controls. For instance, in fiscal year 2014, 15 inspectors general  stated that their agency had appropriately selected a baseline of security  controls, while 16 had reported for fiscal year 2013. In addition, in fiscal  year 2014, 13 inspectors general reported that their agency had  implemented a tailored set of baseline security controls, another decrease  from fiscal year 2013, in which 14 agencies were reported for such  controls.
For fiscal year 2014, according to the inspectors general, 15 agencies  had completed a security authorization package that contained a system  security plan; 8 had not completed one; and 1 inspector general  responded that the question was “not applicable.” This is a decrease from  fiscal year 2013, where 17 agencies had included such a security  authorization package. In addition, inspectors general at 11 agencies  reported that their agency had not always completed or properly updated  their security plan. For example, a component of 1 agency had not  completed one or more key elements of its system security plan, such as  defining the system’s accreditation boundary. Further, at another agency,  five systems had been placed into production without a system security  plan.
Until agencies appropriately develop and update their system security  plans, officials will not be aware of system security requirements or  whether controls are in place.
section_title: Number of Agencies Providing Sufficient Security Awareness Decreased and the Percentage of Personnel Receiving Specialized Training Decreased
paragraphs: FISMA 2002 required agencies to provide security awareness training to  personnel, including contractors and other users of information systems  that support the operations and assets of the agency. Training is intended  to inform agency personnel of the information security risks associated  with their activities and their responsibilities in complying with agency  policies and procedures designed to reduce these risks. FISMA 2002 also  requires agencies to train and oversee personnel who have significant  information security responsibilities. Providing training to agency  personnel is critical to securing information and systems because people  are one of the weakest links when securing systems and networks.
For fiscal year 2014, fewer agencies reported that at least 90 percent of  their users had received security awareness training. The chief  information officers for 22 agencies reported that they had provided  annual security awareness training to at least 90 percent or more of their  network users, which was a decrease from fiscal year 2013, when all 24  agencies reported that they had provided such training. Agency  inspectors general reported similar results. For fiscal year 2014,  inspectors general for 20 agencies reported that their agency had  established a security awareness and training program, which was a  decrease from fiscal year 2013, in which 21 agencies had established  one. Similarly, they reported that fewer agencies had identified and  tracked the status of security awareness training. Specifically, inspectors  general for 16 agencies reported that their agency had identified and  tracked the status of security awareness training in fiscal year 2014, a  decrease from fiscal year 2013, in which 19 agencies had identified and  tracked such training.
For fiscal year 2014, the percentage of personnel with significant security  responsibilities who received training decreased from the previous year.  In February 2015, OMB reported that, for fiscal year 2014, the 24  agencies provided training to an average of 80 percent of personnel who  have significant security responsibilities, which reflects a decrease from  the 92 percent reported for fiscal year 2013.
Without effective security awareness training, agency personnel may not  have a basic understanding of information security requirements to  protect the systems they use. In addition, personnel who did not take  specialized training may lack the knowledge, skills, and abilities  consistent with their roles to protect the confidentiality, integrity, and  availability of the information housed within the information systems to  which they are assigned.
section_title: Fewer Agencies Are Periodically Testing and Continuously Monitoring Controls
paragraphs: FISMA 2002 required that federal agencies periodically test and evaluate  the effectiveness of their information security policies, procedures, and  practices as part of implementing an agency-wide security program. This  testing is to be performed with a frequency depending on risk, but no less  than annually. Testing should include management, operational, and  technical controls for every system identified in the agency’s required  inventory of major systems. This type of oversight is a fundamental  element that demonstrates management’s commitment to the security  program, reminds employees of their roles and responsibilities, and  identifies and mitigates areas of noncompliance and ineffectiveness.  Although control tests and evaluations may encourage compliance with  security policies, the full benefits are not achieved unless the results are  used to improve security.
For fiscal year 2014, inspectors general reported that fewer agencies had  tested and evaluated security controls using appropriate assessment  procedures to determine the extent to which the controls had been  implemented correctly, operated as intended, and produced the desired  outcome with respect to meeting the security requirements for the  system. In fiscal year 2014, 16 inspectors general reported that their  agency had assessed security controls, while 17 agencies had assessed  such controls in fiscal year 2013.
As part of government-wide efforts to improve the testing of controls,  agencies have begun steps to implement continuous monitoring of their  systems. According to NIST, the goal of continuous monitoring is to  transform the otherwise static test and evaluation process into a dynamic  risk mitigation program that provides essential, near real-time security  status and remediation. NIST defines information system continuous  monitoring as maintaining ongoing awareness of information security,  vulnerabilities, and threats to support organizational risk management  decisions. Since March 2012, continuous monitoring has also been  designated as a cross-agency priority area for improving federal  cybersecurity.
Although OMB reported overall increases in the 24 agencies’ continuous  monitoring (from 81 percent in fiscal year 2013 to 92 percent in fiscal year  2014) of controls, inspectors general reported that fewer agencies had  continuously monitored controls for their systems. For example, for fiscal  year 2014, 12 inspectors general stated that their agency had ensured  information security controls were being monitored on an ongoing basis,  including assessing control effectiveness, documenting changes to the  system or its environment of operation, conducting a security impact  analysis of the associated changes, and reporting the security state of the  system to designated organizational officials. This is a decrease from  fiscal year 2013, when 14 agencies had monitored security controls on an  ongoing basis.
If controls are not effectively tested or properly monitored, agencies will  have less assurance that they have been implemented correctly, are  operating as intended, and are producing the desired outcome with  respect to meeting the security requirements of the agency.
section_title: Increasing Number of Agencies are Generally Implementing Elements of a Remediation Program, but Weaknesses Remain
paragraphs: FISMA 2002 required agencies to plan, implement, evaluate, and  document remedial actions to address any deficiencies in their  information security policies, procedures, and practices. In addition, NIST  guidance states that federal agencies should develop a POA&M for  information systems to document the agency’s planned remedial actions  to correct weaknesses or deficiencies noted during the assessment of the  security controls and to reduce or eliminate known vulnerabilities in the  system. Furthermore, the POA&M should identify, among other things,  the resources required to accomplish the tasks, and scheduled  completion dates for the milestones. According to OMB, remediation  plans assist agencies in identifying, assessing, prioritizing, and monitoring  the progress of corrective efforts for security weaknesses found in  programs and systems.
For fiscal year 2014, the number of agencies implementing certain  elements of their remediation programs increased or remained the same.  For fiscal year 2014, inspectors general reported that 16 agencies had  tracked, prioritized, and remediated weaknesses, compared to 15 for  fiscal year 2013. In addition, 11 agencies had established and adhered to  milestone remediation dates in both fiscal years. Further, 16 agencies  were reported having an effective remedial action plan in fiscal year 2014,  an increase from fiscal year 2013, in which 14 reported having such a  plan. For fiscal year 2014, 16 inspectors general reported that their  agency had ensured resources and ownership were provided for  correcting weaknesses, which is also an increase from 14 in fiscal year  2013. Figure 5 shows agencies’ remediation program efforts for fiscal  years 2013 to 2014.
In spite of these increases, inspectors general reported, that for fiscal  year 2014, 19 agencies had established a remediation program, which  was a slight decrease from fiscal year 2013, in which 20 inspectors  general reported such a program. In addition, 18 agencies had  weaknesses in remediating information security weaknesses in fiscal year  2014. For example, according to the inspector general, components of  one agency had inaccurate milestones, did not identify resources to  mitigate weaknesses, and had delays in resolving the weaknesses. The  Inspector General of that agency also identified 517 milestones that were  past due by 12 months.
Without a sound remediation process, agencies have limited assurance  that information security weaknesses are being corrected and addressed  in a timely manner.
section_title: Agencies’ Efforts to Implement Incident Response and Reporting Varied
paragraphs: FISMA 2002 required that agency security programs include procedures  for detecting, reporting, and responding to security incidents and that  agencies report incidents to US-CERT. According to NIST, incident  response capabilities are necessary for rapidly detecting an incident,  minimizing loss and destruction, mitigating the weaknesses that were  exploited, and restoring computing services.
From fiscal year 2013 to fiscal year 2014, agencies’ incident response  efforts varied. For fiscal year 2014, inspectors general reported that 21  agencies had established an incident response program, which is a slight  decrease from fiscal year 2013, in which 22 agencies had established a  program. The number of agencies that had routinely reported security  incidents to US-CERT within the established time frame also decreased  from fiscal year 2013 to fiscal year 2014. Specifically, inspectors general  reported that, for fiscal year 2014, 13 agencies had reported incidents to  US-CERT within the established time frame, which was a decrease from  fiscal year 2013, in which 17 agencies had reported in a timely manner.
Similarly, the number of agencies responding to and resolving incidents  also decreased. Specifically, inspectors general reported that, in fiscal  year 2014, 15 agencies had responded to and resolved incidents in a  timely manner, a decrease from fiscal year 2013, in which 19 agencies  had done so. Similar to fiscal year 2013, in fiscal year 2014, according to  the inspectors general, 18 agencies had sufficient incident monitoring and  detection coverage.
However, inspectors general reported that, in fiscal year 2014, 19  agencies reported incidents to law enforcement, an improvement from  fiscal year 2013, in which 18 agencies had done so. Table 4 summarizes  agency incident reporting and response practices for fiscal years 2013  and 2014.
Also, 19 agencies had performed a comprehensive analysis, validation,  and documentation of incidents in fiscal year 2014, an improvement of 1  agency over the 18 reported in fiscal year 2013, according to the  inspectors general.
Effectively implementing a comprehensive incident detection, reporting,  and response program can help agencies better protect their information  and information systems from cyber attacks.
section_title: Fewer Agencies Had Adequate Contingency Plans
paragraphs: FISMA 2002 required federal agencies to implement plans and  procedures to ensure continuity of operations for information systems that  support the operations and assets of the agency. According to NIST,  contingency planning is part of overall information system continuity of  operations planning, which fits into a much broader security and  emergency management effort that includes, among other things,  organizational and business process continuity and disaster recovery  planning. These plans and procedures are essential steps in ensuring  that agencies are adequately prepared to cope with the loss of  operational capabilities due to a service disruption such as an act of  nature, fire, accident, or sabotage. According to NIST, these plans should  cover all key functions, including assessing an agency’s IT and identifying  resources, minimizing potential damage and interruption, developing and  documenting the plan, and testing it and making the necessary  adjustments.
Similar to fiscal year 2013, in fiscal year 2014, according to the inspectors  general, 17 agencies had established a business continuity and disaster  recovery program that was consistent with FISMA 2002 requirements,  OMB policy, and applicable NIST guidelines.
The number of agencies that had fully implemented certain key elements  of their business continuity and disaster recovery programs decreased,  according to the inspectors general. For example, 12 agencies had  documented business continuity and disaster recovery plans, a decrease  from fiscal year 2013, in which 18 agencies had documented such plans.  The inspectors general also reported that several agencies lacked other  important elements of a continuity of operations program in fiscal year  2014. For example, 10 agencies had not tested their disaster recovery  and business continuity plans, and half of the agencies had not tested  system-specific contingency plans. In addition, 7 agencies had not  developed or tested contingency plans, trained employees for  contingencies, or conducted contingency planning exercises. Further,  inspectors general reported that 6 agencies had not established an  alternate processing site for some systems, and 4 agencies had not  backed up information in a timely manner.
Weaknesses in continuity of operations could lessen the effectiveness of  agencies’ efforts to successfully recover their systems in a timely manner  after a service disruption occurs.
section_title: Agencies Reported Operating Fewer Systems and Relying More on Contractor-Operated Systems
paragraphs: FISMA 2002 required agencies to maintain and update annually an  inventory of major information systems (systems) operated by the agency  or under its control, which includes an identification of the interfaces  between each system and all other systems or networks, including those  not operated by or under the control of the agency. For fiscal years  2013 and 2014, OMB required agencies to report the number of agency  and contractor systems by impact levels.
For fiscal year 2014, the 24 agencies reported a total of 9,906 systems,  composed of 8,378 agency and 1,528 contractor systems, as shown by  impact level in table 5. This represents a slight decrease in the total  number of systems from fiscal year 2013, with the number of agency  systems decreasing and the number of contractor systems increasing  slightly. With respect to impact levels, the total number of low-impact  systems decreased while all others, including the number of  uncategorized systems, increased. Appendix III lists the number of  systems by impact level for each agency, where all agencies reported  having moderate-impact systems, five agencies reported not having any  high-impact systems, and one agency reported not having any low-impact  systems.
Table 5 shows the number of agency and contractor-operated systems by  impact level in fiscal years 2013 and 2014.
In fiscal years 2013 and 2014, OMB also requested that inspectors  general report on agencies’ management of contractor systems.  Inspectors general reported that 14 agencies had obtained sufficient  assurance that security controls of contractor-operated systems and  services had been effectively implemented, compared to 13 in fiscal year  2013.
In August 2014, we reported that five of six agencies we reviewed were  inconsistent in overseeing assessments of contractors’ implementation of  security controls, partly because the agencies had not documented  security procedures for effectively overseeing contractor performance.  We recommended that five of the six agencies develop procedures for the  oversight of contractors. The five agencies generally agreed with the  recommendations.
section_title: More Agencies Implemented Privacy Requirements
paragraphs: Statutory requirements for the protection of personal privacy by federal  agencies are primarily established by the Privacy Act of 1974 and the  privacy provisions of the E-Government Act of 2002. In addition, FISMA  2002 addressed the protection of personal information in the context of  securing federal agency information and information systems. In addition  to these laws, OMB and NIST have issued guidance for assisting  agencies with implementing federal privacy laws. In addition, as part of  the annual FISMA reporting process, agencies are required by OMB to  report on their progress in implementing federal requirements for  protecting the privacy of PII. The requirements include reporting on the  implementation of privacy policies and procedures and whether a privacy  impact assessment was conducted for systems containing PII.
Agencies reported making progress in implementing federal privacy  requirements. For fiscal years 2013 and 2014, according to information  from senior agency privacy officials, all 24 agencies reported having  written policies and processes for their privacy impact assessment  practices. According to OMB, in fiscal year 2014, 95 percent of applicable  systems reported by the 24 agencies also had an up-to-date privacy  impact assessment.
section_title: Amount of Spending on Information Security Varied Among Agencies
paragraphs: Each year, OMB requires agencies to report how much their agency  spends on information security. From fiscal year 2010 to fiscal year 2014,  the 24 agencies reported spending anywhere between 10.3 and 14.6  billion dollars annually on cybersecurity, including 12.7 billion in fiscal  year 2014, which is a 23 percent increase from fiscal year 2013 (see   fig. 6).
For fiscal years 2013 and 2014, agencies reported information security  spending in areas that include 1) preventing malicious cyber activity; 2)  detecting, analyzing, and mitigating intrusions; and 3) shaping the  cybersecurity environment. The amounts the agencies reported  spending in fiscal year 2014 in these three areas are shown in table 6.
section_title: NIST Continues to Provide FISMA-Related Guidance to Agencies
paragraphs: FISMA 2002 established NIST’s role of developing information security  standards and guidelines for federal agencies such as the Federal  Information Processing Standards and the special publications in the 800- series for non-national security federal information systems and assigned  NIST some specific responsibilities, including the development of:
Standards to be used by federal agencies to categorize information  and information systems based on the objectives of providing  appropriate levels of information security according to a range of risk  levels.
Guidelines recommending the types of information and information  systems to be included in each category.
Minimum information security requirements (management,  operational, and technical security controls) for information and  information systems in each such category.
To meet these responsibilities, NIST has continued providing information  security guidelines and updates to existing publications. For example, in  June of 2014, NIST published Supplemental Guidance on Ongoing  Authorization, at the request of OMB. This white paper discusses the  current set of NIST guidance, and how it supports concepts of ongoing  authorizations. Additionally, in September 2014, NIST issued Special  Publication 800-56B, Rev. 1: Recommendation for Pair-Wise Key- Establishment Schemes Using Integer Factorization Cryptography. This  publication is intended to provide vendors with information for  implementing encryption requirements according to FIPS 140-2.
Table 7 lists the dates for FISMA-related publications that NIST plans to  update and issue.
section_title: Inspectors General Report on Agency Implementation of FISMA
paragraphs: FISMA 2002 required that agencies have an independent evaluation  performed each year to evaluate the effectiveness of the agency’s  information security program and practices. FISMA 2002 also required  this evaluation to include (1) testing of the effectiveness of information  security policies, procedures, and practices of a representative subset of  the agency’s information systems and (2) an assessment of compliance  with FISMA 2002 requirements, related information security policies, and  procedures. For agencies with an inspector general, FISMA 2002  required that these evaluations be performed by the inspector general or  an independent external auditor. Lastly, FISMA 2002 required that each  year, agencies submit the results of these evaluations to OMB and that  OMB summarize the results of the evaluations in its annual report to  Congress. According to OMB, the metrics for inspectors general were  designed to measure the effectiveness of agencies’ information security  programs. OMB relies on the responses by inspectors general to gauge  the effectiveness of information security program processes.
Agency inspectors general identified weaknesses in agency information  security programs and practices in fiscal years 2013 and 2014. They  responded to most of the DHS-defined metrics for reporting on agency  implementation of FISMA 2002’s requirements, and most also issued a  detailed audit report discussing the results of their evaluation of agency  policies, procedures, and practices.
section_title: OMB and DHS Continue Actions, but Opportunities Remain for Improving Annual Reporting of Agency Information Security Programs
paragraphs: FISMA 2002 required that OMB, among other things, oversee and  annually report to Congress on agencies’ implementation of information  security policies, standards, and guidelines. To support its oversight  responsibilities, OMB assigned responsibilities to DHS, including  overseeing and assisting government efforts to provide adequate, risk- based, cost-effective cybersecurity. OMB and DHS have continued  overseeing and assisting agencies with implementing and reporting on  cybersecurity, including the following:
CyberStat sessions: According to OMB, these sessions were held  with agencies to ensure they are accountable for their cybersecurity  posture and to assist them in developing a focused strategy for  improving their information security. According to a DHS official, these  sessions were held with eight agencies during fiscal year 2013 and  four agencies during fiscal year 2014. Beginning in fiscal year 2015,  OMB officials stated that that these sessions will be held with  agencies with high risk factors, as determined by cybersecurity  performance and incident data.
Cybersecurity metrics: Each year, OMB and DHS provide metrics to  federal agencies and their inspectors general for preparing FISMA  reports that DHS summarizes for OMB’s report to Congress. The  metrics listed in the reporting guidance help to form the basis for  information on agencies’ progress in implementing FISMA  requirements and in determining whether agencies have met certain  cybersecurity goals set by the current administration.
Proactive scans of publicly-facing agency networks: In October  2014, OMB instructed DHS and federal agencies to implement a  process that allows DHS to conduct regular and proactive vulnerability  scans of the publicly-facing segments of the agencies’ networks. In  addition, DHS is to provide federal agencies with specific results of  the scans; offer additional risk and vulnerability assessment services  at the request of individual agencies; and report to OMB on the  identification and mitigation of risks and vulnerabilities across federal  agencies’ information systems. According to a DHS official, the  department began these scans in February 2015 and has been  issuing more than 100 reports per week to federal departments and  agencies.
In addition, OMB satisfied its FISMA 2002 requirement to annually report  to Congress not later than March 1 of each year on agencies’  implementation of the act. OMB transmitted its fiscal year 2014 report on  February 27, 2015, to Congress and the Comptroller General. The report  highlighted improvements across the federal government such as  increases for CAP goals in continuous monitoring, strong authentication,  and implementing TIC capabilities. Notwithstanding these improvements,  agencies and their inspectors general could further benefit from improved  guidance for reporting measures of performance, as described in the next  section.
subsections: section_title: Guidance for Reporting Agency Evaluations Was Not always Complete
paragraphs: FISMA 2002 specified that OMB, among its other responsibilities, is to  develop policies, principles, standards, and guidelines on information  security and report to Congress. Each year, OMB and DHS provide  guidance to federal agencies and their inspectors general for preparing  their FISMA reports and then summarize the information provided by the  agencies and the inspectors general in OMB’s annual report to Congress.
For fiscal year 2014 annual FISMA reporting, DHS requested that  inspectors general assess their agency’s security program in 11 program  components (e.g. continuous monitoring, configuration management,  security training, among others). For 9 of the 11 program components,  the inspector general is first asked to conclude on whether its agency has  established a program component that is consistent with FISMA 2002  requirements, OMB policy, and applicable NIST guidelines. Inspectors  general are then asked subsequent questions as to whether the program  components include certain attributes listed in the reporting instructions.  These attributes consist of 5 to 16 additional questions such as whether  the agency has documented policies and procedures for that program  component or has implemented controls related to that component.  Inspectors general are asked to respond to their overall assessment of  each program component and the individual attributes using “yes” or “no”  responses.
Our review of fiscal year 2014 responses by inspectors general revealed  that the reporting guidance was not complete. The lack of appropriate  guidance was illustrated by the inconsistent responses to questions  supporting their overall evaluation for each of the 11 agency program  components. For example, in fiscal year 2014, 19 inspectors general  reported that their agency had implemented a continuous monitoring  program. Seventeen of the 19 inspectors general reported that their  agency’s continuous monitoring program included at least 4 of 7 seven  attributes or that the attribute was not applicable. However, two of the  inspectors general reported their agency had implemented a continuous  monitoring program, although those agencies had implemented only 2 of  7 attributes required for the program area.
Other examples we identified illustrate inconsistent inspector general  interpretation in reporting. Fifteen of 24 inspectors general reported that  their agency had a configuration management program in place and that  the program included at least 5 (50 percent) or more of the 10 attributes  or that they had not reviewed those attributes. However, 3 other  inspectors general reported that their agency had not implemented a  configuration management program, even though their program also  included at least 5 (50 percent) or more of the 10 attributes. In addition,  another inspector general responded that the program was in place,  although only 2 of the 10 configuration management attributes were  included in the agency’s program.
In our follow-up with the inspectors general, three provided responses  illustrating inconsistencies with how they interpreted the annual reporting  guidance. Specifically, one pointed out that he based his overall top-level  response of “yes” for the program areas on whether more than 50 percent  of the attributes were in place at his agency. Another replied that, in  addition to OMB and DHS guidance, his agency used an internal  threshold of 70 percent for a “yes” answer and that 69 percent and below  would result in a “no.” The third inspector general responded that he had  reviewed five key elements for each component and then evaluated each  of the 11 program components by determining whether (1) policies and  procedures were in place, (2) controls were designed per policies and  procedures, (3) controls were implemented, and (4) controls were  operating as intended. These variations in how the guidance was  interpreted suggest that additional information on how to incorporate the  attributes into the overall conclusion could be valuable in ensuring  consistent reporting.
The reporting guidance asks inspectors general for an overall  assessment of each program component, but does not define criteria for  inspectors general to provide a “yes” or “no” response on whether the  program component is implemented. In addition, the guidance does not  identify the extent (number or percent of attributes needed for a “yes”) to  which the attributes should be considered into the overall assessment for  each of the components. Therefore, based on our analysis, it appears  that some inspectors general reached the same overall assessment, but  varied in how those attributes affected their rating. Without complete  instructions, differing interpretations of the guidance may therefore result  in responses by inspectors general that are not always comparable for  presenting a clear government-wide picture of agencies’ information  security implementation.
Clarifying reporting guidance to inspectors general for the program areas  they evaluate would further enhance the quality and consistency of  information reported on the government-wide status of federal agencies’  implementation of information security policies, procedures, and  practices. Without consistent criteria for reporting, inspectors general may  be providing Congress and other oversight bodies with uneven  information on the extent to which federal agencies are effectively  implementing security requirements.
In the past, we have reported that performance information derived from  FISMA reporting provides valuable information on the status and progress  of agency efforts to implement effective security management programs,  but that shortcomings in the reporting process needed to be addressed.  For example, we previously recommended that OMB and DHS provide  insight into agencies’ security programs by developing additional metrics  for key security areas such as those for periodically assessing risk and  developing subordinate security plans. We also recommended that  metrics for FISMA reporting be developed to allow inspectors general to  report on the effectiveness of agencies’ information security programs.  OMB and DHS have not yet fully implemented these recommendations.
section_title: Conclusions
paragraphs: Federal agencies’ information and systems remain at a high risk of  unauthorized access, use, disclosure, modification, and disruption. These  risks are illustrated by the wide array of cyber threats, an increasing  number of cyber incidents, and breaches of PII occurring at federal  agencies. Agencies also continue to experience weaknesses with  effectively implementing security controls, such as those for access,  configuration management, and segregation of duties. OMB and federal  agencies have initiated actions intended to enhance information security  at federal agencies. Nevertheless, persistent weaknesses at agencies  and breaches of PII demonstrate the need for improved security. Until  agencies correct longstanding control deficiencies and address the  hundreds of recommendations that we and agency inspectors general  have made, federal systems will remain at increased and unnecessary  risk of attack or compromise.
Federal agencies’ implementation of FISMA during fiscal years 2013 and  2014 was mixed. The number of agencies fully implementing components  of their security programs increased for some elements, such as  developing and documenting policies and procedures, but decreased in  others, such as testing controls or providing security training, and varied  in implementing incident response and reporting. During fiscal years 2013  and 2014, inspectors general continued to identify weaknesses with the  processes agencies used for implementing components of their  programs. As a result, agencies are not effectively implementing the risk- based activities necessary for an effective security program required  under FISMA 2002 and continued under FISMA 2014.
Although OMB and DHS have increased oversight and assistance to  federal agencies in implementing and reporting on information security  programs, inconsistencies remain in reporting by inspectors general.  Some of these inconsistencies could be alleviated with revised guidance  from OMB and DHS. Shortcomings in reporting could result in uneven  information being provided to Congress and other oversight entities and  limit their ability to compare the extent to which federal agencies are  implementing information security programs.
section_title: Recommendation for Executive Action
paragraphs: We recommend that the Director of the Office of Management and  Budget, in consultation with the Secretary of Homeland Security, the  Chief Information Officers Council, and the Council of the Inspectors  General on Integrity and Efficiency, enhance reporting guidance to the  inspectors general for all rating components of agency security programs,  such as configuration management and risk management, so that the  ratings will be consistent and comparable.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to OMB; DHS; the Departments of  Commerce, State, and Treasury; General Services Administration;  National Science Foundation; and the Social Security Administration.  According to a representative from OMB, the agency generally concurred  with our recommendation and provided these comments. During fiscal  year 2015, OMB worked with DHS and the Intelligence Community to  develop and refine the FY 2016 FISMA metrics. Additionally, OMB  continued to work with DHS and the Intelligence Community and has  worked with the Chief Information Officers Council and the Information  Technology Committee for the Council of the Inspectors General on  Integrity and Efficiency to improve the reporting process and enhance  FISMA reporting guidance for the inspector general community,  respectively.
In written comments (reproduced in appendix IV), SSA’s Executive  Counselor to the Commissioner stated that the agency takes a proactive  approach to identifying and mitigating risk associated with access to their  secure network. In e-mail responses, the audit liaison for DHS and  Commerce provided technical comments, which we have incorporated as  appropriate. Officials from the Departments of State and Treasury, the  General Services Administration, and the National Science Foundation  responded that their agency did not have any comments.
We are sending copies of this report to the Director of the Office of  Management and Budget, the Secretary of Homeland Security, and other  interested parties. In addition, this report will be available at no charge on  the GAO website at http://www.gao.gov.
If you have any questions regarding this report, please contact me at  (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Key contributors to this report are listed in appendix V.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to evaluate (1) the adequacy and effectiveness of  federal agencies’ information security policies and procedures and (2) the  extent to which federal agencies have implemented the requirements of  the Federal Information Security Management Act (FISMA) of 2002.
To assess the adequacy and effectiveness of agencies’ information  security policies and practices, we reviewed and analyzed our, agency,  and inspectors general information security-related reports that were  issued from October 2013 through May 2015 and covered agencies’ fiscal  years 2013 and 2014 security efforts. We reviewed and summarized  weaknesses identified in these reports using the five major categories of  information security general controls identified in our Federal Information  System Controls Audit Manual: (1) access controls, (2) configuration  management controls, (3) segregation of duties, (4) contingency planning,  and (5) security management controls. In addition, we reviewed and  analyzed financial and performance and accountability reports of the 24  major federal agencies covered by the Chief Financial Officers Act for  fiscal years 2013 and 2014.
To evaluate the extent to which the agencies have implemented FISMA’s  requirements, we reviewed and analyzed the provisions of the 2002 act.  We reviewed and analyzed the provisions of the act to identify agency,  Office of Management and Budget (OMB), Department of Homeland  Security (DHS), and National Institute of Standards and Technology  (NIST) responsibilities for implementing, overseeing, and providing  guidance for agency information security. We did not evaluate agencies’  implementation of the Federal Information Security Modernization Act of  2014 (FISMA 2014), but we compared it to the 2002 act’s requirements to  identify revised responsibilities for OMB, DHS, and federal agencies. We  also reviewed OMB and DHS’ annual FISMA reporting guidance, and  OMB’s annual reports to Congress for fiscal years 2013 and 2014 FISMA  implementation. In addition, we analyzed, categorized, and summarized  the annual FISMA data submissions for fiscal years 2013 and 2014 by  each agency’s chief information officer, inspector general, and senior  agency official for privacy.
To assess the reliability of the agency-submitted data we obtained via  CyberScope, we reviewed FISMA reports that agencies provided to  corroborate the data. In addition, we selected 6 agencies to gain an  understanding of the quality of the processes in place to produce annual  FISMA reports. To select these agencies, we sorted the 24 major  agencies from highest to lowest using the total number of systems each  agency had reported in fiscal year 2013; separated them into even  categories of large, medium, and small agencies; then selected the last 2  agencies from each category. These agencies were the Departments of  Commerce, State, and the Treasury; the General Services Administration;  the National Science Foundation; and the Social Security Administration.  We conducted interviews and collected data from the inspectors general  and agency officials from the selected agencies to determine the reliability  of data submissions. As appropriate, we interviewed officials from OMB,  DHS, and NIST. Based on this assessment, we determined that the data  were sufficiently reliable for our work.
We conducted this performance audit from December 2014 to September  2015 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Cyber Threats and Exploits
section_title: Appendix III: Number of Agency and Contractor-Operated Systems by Impact Level
paragraphs: Appendix III: Number of Agency and  Contractor-Operated Systems by Impact Level The Departments of Agriculture (USDA), Commerce, Defense (DOD), Education, Energy, Health and  Human Services (HHS), Homeland Security (DHS), Housing and Urban Development (HUD), the  Interior, Justice, Labor, State, Transportation, the Treasury, and Veterans Affairs (VA); the  Environmental Protection Agency (EPA); General Services Administration (GSA); National  Aeronautics and Space Administration (NASA); National Science Foundation (NSF); Nuclear  Regulatory Commission (NRC); Office of Personnel Management (OPM); Small Business  Administration (SBA); Social Security Administration (SSA); and the U.S. Agency for International  Development (USAID).
section_title: Appendix IV: Comments from the Social Security Administration
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contacts named above, Larry Crosland (assistant  director), Christopher Businsky, Rosanna Guerrero, Nancy Glover, Angel  Ip, Fatima Jahan, Carlo Mozo, and Shaunyce Wallace made key  contributions to this report.