Information Security: National Archives and Records Administration Needs to Implement Key Program Elements and Controls
Published: 2010-10-21T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The National Archives and Records Administration (NARA) is responsible for preserving access to government documents and other records of historical significance and overseeing records management throughout the federal government. NARA relies on the use of information systems to receive, process, store, and track government records. As such, NARA is tasked with preserving and maintaining access to increasing volumes of electronic records. GAO was asked to determine whether NARA has effectively implemented appropriate information security controls to protect the confidentiality, integrity, and availability of the information and systems that support its mission. To do this, GAO tested security controls over NARA's key networks and systems; reviewed policies, plans, and reports; and interviewed officials at nine sites.
section_title: What GAO Found
paragraphs: NARA has not effectively implemented information security controls to sufficiently protect the confidentiality, integrity, and availability of the information and systems that support its mission. Although it has developed a policy for granting or denying access rights to its resources, employed mechanisms to prevent and respond to security breaches, and made use of encryption technologies to protect sensitive data, significant weaknesses pervade its systems. NARA did not fully implement access controls, which are designed to prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities. Specifically, the agency did not always (1) protect the boundaries of its networks by, for example, ensuring that all incoming traffic was inspected by a firewall; (2) enforce strong policies for identifying and authenticating users by, for example, requiring the use of complex (i.e., not easily guessed) passwords; (3) limit users' access to systems to what was required for them to perform their official duties; (4) ensure that sensitive information, such as passwords for system administration, was encrypted so as not to be easily readable by potentially malicious individuals; (5) keep logs of network activity or monitor all parts of its networks for possible security incidents; and (6) implement physical controls on access to its systems and information, such as securing perimeter and exterior doors and controlling visitor access to computing facilities. In addition to weaknesses in access controls, NARA had mixed results in implementing other security controls. For example: (1) NARA did not always ensure equipment used for sanitization (i.e., wiping clean of data) and disposal of media (e.g., hard drives) was tested to verify correct performance. (2) NARA conducted appropriate background investigations for employees and contractors to ensure sufficient clearance requirements have been met before permitting access to information and information systems. (3) NARA did not consistently segregate duties among various personnel to ensure that no one person or group can independently control all key aspects of a process or operation. The identified weaknesses can be attributed to NARA not fully implementing key elements of its information security program. Specifically, the agency did not adequately assess risks facing its systems, consistently prepare and document security plans for its information systems, effectively ensure that all personnel were given relevant security training, effectively test systems' security controls, consistently track security incidents, and develop contingency plans for all its systems. Collectively, these weaknesses could place sensitive information, such as records containing personally identifiable information, at increased and unnecessary risk of unauthorized access, disclosure, modification, or loss.
section_title: What GAO Recommends
paragraphs: GAO is making 11 recommendations to the Archivist of the United States to implement elements of NARA's information security program. In commenting on a draft of this report, the Archivist generally concurred with GAO's recommendations but disagreed with some of the report's findings. GAO continues to believe that the findings are valid.

section_title: Letter
paragraphs: The National Archives and Records Administration (NARA) is responsible  for managing and archiving government records, which increasingly  involves dealing with documents that are created and stored  electronically. In 2001, NARA responded to the challenge of preserving,  managing, and providing access to electronic records by initiating the  development of the Electronic Records Archives (ERA).
As the nation’s record keeper, NARA is responsible for significant amounts  of sensitive information. In 2009 NARA experienced a data breach wherein  a hard drive containing data from the Clinton Administration was lost. The  hard drive reportedly contained classified information and Social Security  numbers of former White House staffers and visitors.
In response to your request, we conducted an evaluation of NARA’s  information security program. Our objective was to determine whether  NARA has effectively implemented appropriate information security  controls to protect the confidentiality, integrity, and availability of the  information and systems that support its mission. To accomplish this  objective, we examined computer security controls over networks  supporting nine sites to determine whether information was safeguarded  and protected from unauthorized access. We also reviewed and analyzed  NARA’s security policies, plans, and reports and interviewed key agency  officials.
We performed this performance audit from December 2009 to October  2010, in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objective. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objective. See appendix I for a complete  description of our objective, scope, and methodology.
subsections: section_title: Background
paragraphs: Information security is a critical consideration for any organization reliant  on information technology (IT) and especially important for government  agencies, such as NARA, where maintaining the public’s trust is essential.  The dramatic expansion in computer interconnectivity and the rapid  increase in the use of the Internet have changed the way our government,  the nation, and much of the world communicate and conduct business.  Although this expansion has created many benefits for agencies in  achieving their missions and providing information to the public, it also  exposes federal networks and systems to various threats.
Without proper safeguards, systems are unprotected from attempts by  individuals and groups with malicious intent to intrude and use the access  to obtain sensitive information, commit fraud, disrupt operations, or  launch attacks against other computer systems and networks. This  concern is well-founded for a number of reasons, including the dramatic  increase in reports of security incidents, the ease of obtaining and using  hacking tools, the steady advance in the sophistication and effectiveness  of attack technology, and the dire warnings of new and more destructive  attacks to come. Over the past few years, federal agencies have reported  an increasing number of security incidents, many of which involved  sensitive information that has been lost or stolen, including personally  identifiable information, which has exposed millions of Americans to the  loss of privacy, identity theft, and other financial crimes.
subsections: section_title: NARA Is a Key Steward of Federal Records
paragraphs: NARA is the nation’s record keeper. It was created by statute as an  independent agency in 1934. On July 1, 1949, the Federal Property and  Administrative Services Act transferred the National Archives to the  General Services Administration, and its name was changed to National  Archives and Records Services. It attained independence again as an  agency in October 1984 (effective April 1, 1985) and became known as the  National Archives and Records Administration. NARA’s mission is to  ensure continuing access to essential documentation of the rights of  American citizens and the actions of their government. NARA also  publishes the Federal Register, stores classified materials, and plays a role  in the declassification of these classified records.
The Archivist of the United States is NARA’s chief administrator and has  responsibilities that include providing federal agencies with guidance and  assistance for records management and establishing standards for records  retention. The Archivist also has overall responsibility for ensuring the  confidentiality, integrity, and availability of the information and  information systems that support the agency and its operations. The  Assistant Archivist for Information Services has the responsibilities of  NARA’s Chief Information Officer.
In fiscal year 2009, NARA’s appropriation was about $459 million, while its  fiscal year 2010 appropriation is about $470 million. NARA is composed of  six major divisions (see table 1) that include 44 facilities such as the  headquarters locations in Washington, D.C., and College Park, Maryland;  presidential libraries; and regional archives nationwide.
section_title: NARA Relies on Information Systems to Accomplish Its Mission
paragraphs: NARA depends on a number of key information systems to conduct its  daily business functions and support its mission. These systems include  networks, telecommunications, and specific applications. As of fiscal year  2009, NARA reported having 39 IT systems and 4 externally hosted  systems. According to NARA, as part of its key transformation initiative, in  2001 the agency responded to the challenge of preserving, managing, and  assessing electronic records by beginning the development of the modern  Electronic Records Archives (ERA) system. This major information  system is intended to preserve and provide access to massive volumes of  all types and formats of electronic records, independent of their original  hardware or software. NARA plans for the system to manage the entire life  cycle of electronic records, from their ingestion through preservation and  dissemination to customers. We have previously made numerous  recommendations to NARA to improve its acquisition and monitoring of  the system.
Table 2 lists examples of key NARA systems.
The Office of Information Services at the Archives II facility provides  centralized management and control of NARA’s IT resources and services,  including NARANET, the primary general support system of NARA. As  shown in figure 1, NARANET is centrally located at Archives II and  connects to other government and academic entities. NARANET is  extended to field sites via a private network, operated by a service  provider. In addition, at locations where the public has research access,  NARA provides access to the Internet through the use of public access  computers.
section_title: NARA’s Information System Security Program
paragraphs: The Federal Information Security Management Act of 2002 (FISMA)  requires each federal agency to develop, document, and implement an  requires each federal agency to develop, document, and implement an  agencywide information security program to provide security for the  agencywide information security program to provide security for the  information and information systems that support the operations and  information and information systems that support the operations and  assets of the agency, including those provided or managed by other  assets of the agency, including those provided or managed by other  agencies, contractors, or other sources. FISMA requires the Chief  agencies, contractors, or other sources. FISMA requires the Chief  Information Officer or comparable official at federal agencies to be  Information Officer or comparable official at federal agencies to be  responsible for developing and maintaining an information security  responsible for developing and maintaining an information security  program.  program.
The Office of Information Services centrally administers NARA’s IT  The Office of Information Services centrally administers NARA’s IT  security program at the Archives II facility. The Assistant Archivist for  security program at the Archives II facility. The Assistant Archivist for  Information Services, who also serves as the Chief Information Officer  Information Services, who also serves as the Chief Information Officer  (CIO), is the head of the Office of Information Services. As described in  (CIO), is the head of the Office of Information Services. As described in  table 3, NARA has designated certain senior managers or divisions at  table 3, NARA has designated certain senior managers or divisions at  headquarters to fill the key roles in IT security designated by FISMA and  headquarters to fill the key roles in IT security designated by FISMA and  agency policy.  agency policy.
FISMA also requires the National Institute of Standards and Technology  (NIST) to provide standards and guidance to agencies on information  security. NARA has a directive in place to establish its policy and guidance  for information security, delineate its security program structure, and  assign security responsibilities.
section_title: Control Weaknesses Threaten Record Retention
paragraphs: NARA has taken steps to safeguard the information and systems that  support its mission. For example, it has developed a policy for granting or  denying access rights to its resources, employs mechanisms to prevent  and respond to security breaches, and makes use of encryption  technologies to protect sensitive data.
However, security control weaknesses pervaded NARA’s systems and  networks, thereby jeopardizing the agency’s ability to sufficiently protect  the confidentiality, integrity, and availability of its information and  systems. These deficiencies include those related to access controls, as  well as other controls such as configuration management and segregation  of duties. A key reason for these weaknesses is that NARA has not yet fully  implemented its agencywide information security program to ensure that  controls are appropriately designed and operating effectively. These  weaknesses could affect NARA’s ability to collect, process, and store  critical information and records, and protect that information from risk of  unauthorized use, modification, and disclosure.
subsections: section_title: Weaknesses in Other Controls Increase Risk
paragraphs: In addition to access controls, other important controls should be in place  to ensure the confidentiality, integrity, and availability of an organization’s  information. These controls include policies, procedures, and techniques  for securely configuring information systems, sufficiently disposing of  media, implementing personnel security, and segregating incompatible  duties. Weaknesses in these areas increase the risk of unauthorized use,  disclosure, modification, or loss of sensitive information and information  systems supporting NARA’s mission.
subsections: section_title: Configuration Management Controls Were Not Sufficient
paragraphs: One of the purposes of configuration management is to establish and  maintain the integrity of an organization’s work products. It involves  identifying and managing security features for all hardware, software, and  firmware components of an information system at a given point and  systematically controlling changes to that configuration during the  system’s life cycle. By implementing configuration management and  establishing and maintaining baseline configurations and monitoring  changes to these configurations, organizations can better ensure that only  authorized applications and programs are placed into operation. NARA  policy requires the most restrictive mode possible of the security settings  of information technology products. NIST standards state and NARA  policy requires system changes to be controlled. Patch management is an  additional component of configuration management, and is an important  factor in mitigating software vulnerability risks. Up-to-date patch  installation can help diminish vulnerabilities associated with flaws in  software code. NIST states that organizations should promptly install  newly released security relevant patches, service packs, and hot fixes and  test them for effectiveness and potential side effects on the organization’s  information systems.
NARA had not securely configured several of its systems. For example,  network configurations were not always restricted in accordance with  best practices; additionally, Web applications and operating systems were  not always restricted in accordance with NIST guidance.
While NARA has maintained and tracked configuration changes for its  ERA system, it has not consistently documented the status of those  changes. NARA documented, maintained, and tracked approvals for ERA’s  system change requests in its meeting minutes as well as in a system for  managing those change requests, but the information in meeting minutes  and the change repository were inconsistent. For example, change  requests agreed to in meeting minutes from October 2009 to March 2010  did not always match those entered in the repository storing those  changes. Specifically, some change requests were approved for  implementation in the meeting, but were listed in the repository as closed.  Others were reflected as being on hold, but were actually listed as  canceled in the repository. According to ERA configuration management  staff, these inconsistencies exist because the configuration control board  status represents a single point in time of each change request. Subsequent  changes to the system related to each change request are handled by  release management staff. Therefore, the status in the repository will  continue to change. Configuration management staff have the  responsibility to document updates to changes in status at various points  in the process.
In addition, NARA had not implemented an effective patch management  program for the systems we reviewed. For example, patches had not been  consistently applied to critical systems or applications in a timely manner.  Specifically, several critical systems had not been patched or were out of  date, some of which had known vulnerabilities. Additionally, NARA used  out-of-date or unsupported software and products in some instances.
As a result of these control deficiencies, increased risk exists that the  integrity of NARA systems could be compromised.
section_title: NARA Did Not Consistently Test Equipment Used to Sanitize Media
paragraphs: Media destruction and disposal is key to ensuring confidentiality of  information. Media can include magnetic tapes, optical disks (such as  compact disks), and hard drives. Organizations safeguard used media to  ensure that the information they contain is appropriately controlled. Media  that is improperly disposed of can lead to the inappropriate or inadvertent  disclosure of an agency’s sensitive information or the personally  identifiable information of its employees and customers. NARA uses  degaussers to remove sensitive information from hard drives and tapes  before reuse or destruction. This equipment should then be certified that it  was tested and that it performed correctly. NIST recommends that  organizations test sanitization equipment and procedures to verify correct  performance. NARA’s policy for protection of media requires that  sanitization equipment be tested annually.
However, NARA has not always ensured that equipment used for removing  sensitive information was tested annually. For example, while the  degausser located at one location was certified annually, one at another  location was not. Specifically, one degausser was certified on January  2010, while the other had not been certified since July 2008, about 20  months prior to our on-site visit. By not testing and certifying its  degausser, NARA has reduced assurance that the equipment is performing  according to certified requirements.
section_title: Personnel Security Controls Are in Place
paragraphs: The greatest harm or disruption to a system comes from the actions, both  intentional and unintentional, of individuals. These intentional and  unintentional actions can be reduced through the implementation of  personnel security controls. According to NIST, personnel security  controls help organizations ensure that individuals occupying positions of  responsibility (including third-party service providers) are trustworthy and  meet established security criteria for those positions. For employees and  contractors assigned to work with confidential information,  confidentiality, nondisclosure, or security access agreements specify  required precautions, acts of unauthorized disclosure, contractual rights,  and obligations during employment and after termination. NARA’s security  policy for personnel screening states that the type of investigation is based  on the sensitivity of the position to be held.
NARA conducted the appropriate background investigations for the  employees and contractors we reviewed. These individuals also had  appropriate nondisclosure agreements signed when applicable to their  position. However, at one location contractors had not signed  nondisclosure agreements for the ERA system. NARA staff acknowledged  the issue and subsequently had the contractors sign the nondisclosure  agreements.
section_title: Incompatible Duties Were Not Always Effectively Segregated
paragraphs: Segregation of duties refers to the policies, procedures, and organizational  structures that help ensure that no single individual can independently  control all key aspects of a process or computer-related operation and  thereby gain unauthorized access to assets or records. Often,  organizations achieve segregation of duties by dividing responsibilities  among two or more individuals or organizational groups. This diminishes  the likelihood that errors and wrongful acts will go undetected, because  the activities of one individual or group will serve as a check on the  activities of the other. Effective segregation of duties includes segregating  incompatible duties and maintaining formal operating procedures,  supervision, and review. Inadequate segregation of duties increases the  risk that erroneous or fraudulent transactions could be processed,  improper program changes implemented, and computer resources  damaged or destroyed. For systems categorized as high or moderate  impact, NIST states that incompatible duties should be segregated, such  as, by not allowing security personnel who administer system access  control functions to administer audit functions. NARA also has a policy  requiring segregation of duties.
NARA did not always implement effective segregation of duties controls.  For example, two staff members were each assigned security and system  administration roles and responsibilities, as either a primary or backup for  the ERA system (a high impact system). In addition, those individuals had  privileges that allowed them to delete logs generated by the system used  for auditing and logging security events. According to NARA staff, periodic  reviews of the administrators’ access were performed using checklists that  require administrators to review each other’s access activities. However at  the time of our review, NARA had not documented its oversight process to  ensure controls for separation of duties were implemented appropriately.  As a result, NARA may face an increased risk that improper program  changes or activities could go unnoticed.
section_title: NARA Has Not Fully Implemented All Elements of Its Information Security Program
paragraphs: A key reason for the weaknesses in information security controls intended  to protect NARA’s systems is that the agency has not yet fully  implemented its agencywide information security program to ensure that  controls are effectively established and maintained. FISMA requires each  agency to develop, document, and implement an information security  program that, among other things, includes    periodic assessments of the risk and the magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;   policies and procedures that (1) are based on risk assessments, (2) cost- effectively reduce risks, (3) ensure that information security is addressed  throughout the life cycle of each system, and (4) ensure compliance with  applicable requirements;   plans for providing adequate information security for networks, facilities,    security awareness training to inform personnel of information security  risks and of their responsibilities for complying with agency policies and  procedures, as well as training personnel with significant security  responsibilities for information security;    periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, which is to be performed with a  frequency depending on risk, but no less than annually, and which  includes testing the management, operational, and technical controls for  every system identified in the agency’s required inventory of major  information systems;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices;   procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency.
Although NARA has developed and documented a framework for its  information security program, key components of the program have not  been fully or consistently implemented.
subsections: section_title: NARA Developed Risk Assessments but Inconsistently Implemented Risk-Related Procedures
paragraphs: In order for agencies to determine what security controls are needed to  protect their information resources, they must first identify and assess  their information security risks. FIPS publication 199 provides risk-based  criteria to identify and categorize information and information systems  based on their impact to the organization’s mission. In addition, the Office  of Management and Budget (OMB) states that a risk-based approach is  required to determine adequate security, and it encourages agencies to  consider major risk factors, such as the value of the system or application,  threats, vulnerabilities, and the effectiveness of current or proposed  safeguards. By increasing awareness of risks, these assessments can  generate support for policies and controls. NIST states that organizations  should also assess physical security risks to their facilities when they  perform required risk assessments of their information systems. Federal  standards require that NARA conduct vulnerability risk assessments at  least every 3 years for the buildings and facilities we visited.
NARA has developed and conducted risk assessments, but has not  consistently documented risk or assessed risk in a timely manner at its  facilities. For example, NARA had developed risk assessments for all 10 of  the systems in our review, but other system documentation for 4 of the 10  systems cited FIPS 199 impact levels that did not match those listed in  NARA’s systems inventory. Documents for 3 systems reflected impact  ratings higher than those listed in the systems inventory and the fourth one  reflected a lower rating. Similarly, while NARA had conducted physical  security risk assessments for the sites we reviewed, several had not been  conducted within the required 3-year time frame. As a result, NARA may  not have assurance that adequate controls are in place to protect its  information and information systems.
section_title: NARA’s Policies and Procedures Were Not Always Consistent with Federal Guidance
paragraphs: Another key element of an effective information security program is to  develop, document, and implement risk-based policies, procedures, and  technical standards that govern security over an agency’s computing  environment. FISMA requires agencies to develop and implement policies  and procedures to support an effective information security program. If  properly implemented, policies and procedures should help reduce the  risk that could come from unauthorized access or disruption of services.  Developing, documenting, and implementing security policies are the  primary mechanisms by which management communicates its views and  requirements; these policies also serve as the basis for adopting specific  procedures and technical controls.
NARA has developed information security policies and procedures that are  based on NIST guidelines. For example, NARA has developed individual  policy documents that address all of the families of controls listed in NIST  Special Publication 800-53. To illustrate, NARA has developed  information security methodologies that correspond to the controls  required by NIST in the areas of access controls, configuration  management, contingency planning, and security awareness training.
However, NARA’s policies and procedures were not always consistent  with NIST guidance. For example, NARA has not always prescribed  controls based on the system’s impact. NIST requires organizations to  determine their information systems’ impact using the security objectives  of confidentiality, integrity, and availability and states that this information  system impact level must be determined prior to the consideration of  minimum security requirements and the selection of security controls for  those information systems. Instead, NARA prescribed controls based on  individual security objectives without taking into consideration the  predetermined impact level (based on the three security objectives) of an  individual system. To illustrate, NARA’s access control policy only  specifies controls for systems with moderate or high confidentiality, rather  than suggesting controls according to the impact of the system, as  determined by all three security objectives. Similarly, NARA’s certification  and accreditation and contingency planning methodologies prescribed  controls for systems with moderate or high integrity and availability,  respectively, and not based on the impact level of the system. As a result,  NARA’s policy may not provide the information needed to ensure that  appropriate systems controls are selected that protect its information  systems.
section_title: Security Plans Contained Varying Levels of Information and Did Not Always Address Required Controls
paragraphs: An objective of system security planning is to improve the protection of  information technology resources. A system security plan provides an  overview of the system’s security requirements and describes the controls  that are in place—or planned—to meet those requirements. OMB Circular  No. A-130 requires that agencies develop system security plans for major  applications and general support systems, and that these plans address  policies and procedures for providing management, operational, and  technical controls. NIST Special Publication 800-53 states that the  security plan should be updated to address changes to the system, its  environment of operation, or problems identified during plan  implementation or security control assessments. One of the controls  recommended by NIST Special Publication 800-53 is the development of  an inventory of an information system’s components. This inventory  should, among other things, accurately reflect the current information  system, be consistent with the authorized boundary of the system, and be  available for review. NARA’s Security Architecture Planning Methodology  also outlines security responsibilities, including responsibilities for  information system owners and information owners to carry out related to  system security plans. This methodology in turn mandates the use of  baseline controls identified by NIST in Special Publication 800-53.
NARA prepared and documented security plans for the 10 systems and  networks we reviewed. All system security plans that we reviewed, with  the exception of NARANET’s wireless plan, identified management,  technical, and operational controls, in accordance with NIST guidance and  NARA policy.
However, NARA did not always include required controls in its system  security plans. For example, 7 of the 13 system security plans reviewed  did not include a system component inventory or address where that  inventory could be found. In addition, NARA has not updated its badge  and access system security plan since 2003, despite replacing the system in  2007. NARA had scheduled to correct this weakness by the end of 2009,  but as of September 2010 it had not been corrected. Further, NARA system  security plans varied in documenting security roles and responsibilities for  key individuals. Some plans were missing one or more assignments for  these roles. Specifically, 6 of the 13 plans did not have the required  information system owner role identified, and none of the plans reviewed  had the information owner role identified or assigned.
By not addressing inventory control and assigning key security  responsibilities in the system security plan, NARA increases the risk that  critical information may not be available to those responsible for  implementing system security plans, potentially causing a misapplication  of controls to the system.
section_title: Security Awareness Training and Specialized Security Training Were Not Effectively Tracked
paragraphs: According to FISMA, an agencywide information security program must  include security awareness training for agency personnel, contractors, and  other users of information systems that support the agency’s operations  and assets. This training must cover (1) information security risks  associated with users’ activities and (2) users’ responsibilities in  complying with agency policies and procedures designed to reduce these  risks. FISMA also includes requirements for training personnel with  significant responsibilities for information security. In addition, OMB  requires that personnel be trained before they are granted access to  systems or applications. The training is intended to ensure that personnel  are aware of the system or application’s rules, their responsibilities, and  their expected behavior. Further, NARA policy requires that managers and  users of NARA information systems be made aware of the security risks  associated with their activities and of the applicable laws, executive  orders, directives, policies, standards, instructions, regulations, or  procedures related to the security of NARA information systems. The  policy also states that NARA must ensure that personnel are adequately  trained to carry out their assigned information security-related duties and  responsibilities.
NARA has a security awareness training program in place and maintains  records of this training in its Learning Management System. Users are  required to complete a Web-based course and, after completion,  acknowledge they have reviewed and understand their security  responsibilities. According to NARA’s fiscal year 2009 FISMA report, the  CIO reported that 100 percent of NARA’s employees had received security  awareness training. NARA’s Inspector General concurred with this  assessment. The CIO also reported that 50 employees had significant  security responsibilities, and that all 50, had received specialized training.  NARA’s Inspector General reported a higher number stating that 114  employees had significant security responsibilities, and that 83 (73  percent) received specialized training.
However, records from NARA’s training system indicated that not all users  had both completed the training and acknowledged that they reviewed and  understood their security responsibilities in fiscal year 2009. According to  NARA’s records, as of August 20, 2009, 563 of 4,536 individuals had  completed only the class portion (12 percent) and 369 individuals (8  percent) had completed only the acknowledgment portion (although in  many cases had at least started the class portion). Seven hundred and  forty-nine individuals (17 percent) had not completed either portion (see  fig. 2).
According to NARA’s Chief Information Security Officer, limitations in the  training tracking system led NARA to give credit for a user interacting with  the system in some way, meaning that a user who had at least started the  training course received credit for the security awareness training. In  addition, records of specialized security training provided by NARA  indicated that 115 individuals were required to take specialized security  training; of these 115, 48 (42 percent) had no record of taking specialized  training. NARA officials stated that these individuals were provided with  an alternate form of training to ensure their compliance with FISMA, such  as a one-on-one review or an opportunity to review briefing slides.
Without an effective method for tracking that employees and contractors  fully complete security awareness training, NARA has less assurance that  staff are aware of the information security risks and responsibilities  associated with their activities. In addition, without ensuring that all  employees with specialized security responsibilities receive adequate  specialized training, NARA’s ability to implement security measures  effectively could be limited.
section_title: NARA Did Not Fully Test Controls
paragraphs: A key element of an information security program is to test and evaluate  policies, procedures, and controls to determine whether they are effective  and operating as intended. This type of oversight is fundamental because it  demonstrates management’s commitment to the security program,  reminds employees of their roles and responsibilities, and identifies and  mitigates areas of noncompliance and ineffectiveness. FISMA requires that  the frequency of tests and evaluations of management, operational, and  technical controls be based on risks and occur no less than annually. OMB  requires that systems be authorized for processing at least every 3 years.  NARA’s policy for testing is consistent with FISMA and requires that  certification testing be conducted in support of system authorizations or  accreditations.
NARA had conducted tests for each of the 10 systems we reviewed;  however, it had not sufficiently tested controls for 2 systems. For example,  the management and operational controls for 1 system were not tested at  least annually. Although NARA tested technical controls and documented  test results for that system, it did not test and document the results for the  system’s management and operational controls. Another system had not  been tested to support its accreditation since 2003. While an annual  assessment was conducted in 2009 for that system, NARA’s 2007 security  accreditation memorandum stated that certification testing had not been  performed. As a result, NARA may have reduced assurance that controls  over its information and information systems are adequately implemented  and operating as intended.
section_title: Remedial Action Plans Were Not Reliably Maintained
paragraphs: Remedial action plans, also known as plans of action and milestones  (POA&M), help agencies identify and assess security weaknesses in  information systems, set priorities, and monitor progress in correcting the  weaknesses. NIST guidance states that each federal civilian agency must  report all incidents and internally document remedial actions and their  impact. POA&Ms should be updated to show progress made on current  outstanding items and to incorporate the results of the continuous  monitoring process. In addition, FISMA and NARA policy require the  agency CIO to report annually to the agency head on the effectiveness of  the agency information security program, including progress on remedial  actions.
NARA has implemented a remedial action process to assess and correct  security weaknesses. The format for its system-level POA&Ms includes the  types of information specified in NIST and OMB guidance, such as a  description of the weakness, resources required to mitigate it, scheduled  completion date, the review that identified the weakness, and the status of  corrective actions (ongoing or completed).
Although NARA has developed POA&Ms to address known weaknesses,  the agency does not always update these plans or complete remedial  actions in a timely manner. For example, a POA&M for a system designed  to receive, preserve, and provide access to electronic records is dated  December 2008. None of the remedial actions described in this plan were  marked as completed as of April 2010. Additionally, 8 of 10 POA&Ms that  we assessed contained blank entries or “to be determined” notations for  some required information. These 8 did not provide all of the information  for resources needed, scheduled completion dates, milestones, or the  security review that identified the weakness.
In addition, a POA&M maintained by the Office of Information Services did  not include information about resources required to correct these  weaknesses. This lack of information about resource requirements may  inhibit the agency’s efforts to correct the security weaknesses. Outdated  and incomplete POA&Ms compromise the ability of the CIO and other  NARA officials to track, assess, and report accurately the status of the  agency’s information security.
section_title: Security Incident Tracking Was Inconsistent
paragraphs: Although strong controls may not block all intrusions and misuse,  agencies can reduce the risks associated with such events if they take  steps to detect and respond to them before significant damage occurs.  Accounting for and analyzing security problems and incidents are also  effective ways for an agency to improve its understanding of threats and  the potential costs of security incidents, and doing so can pinpoint  vulnerabilities that need to be addressed so that they are not exploited  again. FISMA requires that each federal agency implement an information  security program that includes procedures for detecting, reporting, and  responding to security incidents. When incidents occur, agencies are to  notify the federal information security incident center—the United States  Computer Emergency Readiness Team (US-CERT).
NARA has an incident response methodology and maintains an incident  database with information about the categorization and analysis of  incidents. However, NARA was not able to locate all of its weekly reports  for incidents and did not consistently apply its criteria for incident  categorization. According to the NARA incident response methodology,  incidents involving the disclosures of personally identifiable information,  even if the disclosure did not involve an IT system, should be categorized  under “Investigation” (Category 6). While the records indicate that NARA  reported these disclosures to US-CERT, NARA did not list them as  Category 6.
NARA also categorized many of its computer security incidents  inconsistently. Of 640 total incidents, 139 were classified as “Explained  Anomaly” (Category 7). According to the NARA incident response  methodology, this category is usually reserved for false positives and other  explained anomalies. However, NARA classified a number of incidents in  this category, even when the incident was not a false positive or could  have been placed into another category. For example, NARA experienced  site-redirection events—where a user was unwittingly directed to a  malicious Web site while trying to access a legitimate site. This is a form of  social engineering, which is categorized in the NARA incident response  methodology under a separate category (Category 5). In addition,  incidents where encrypted laptops were stolen were included in the  “Explained Anomaly” category, though the NARA incident response  methodology indicates that they should have been placed in Category 1,  which indicates that unauthorized access may have occurred.
NARA policy requires that staff be assigned and trained for the incident  response team. While NARA tracks information security incidents and  their resolution, it has not formally tracked training held for incident  response. NARA officials have stated that they are in the process of  formalizing this training program. Without ensuring that incident response  personnel have received appropriate training, NARA’s ability to implement  security measures effectively could be limited. Further, without  categorizing incidents appropriately, NARA’s ability to analyze incidents  for follow-on actions could be diminished, and corrective actions for  protecting agency resources may not be taken.
section_title: Contingency Plans Were Developed for Most Systems
paragraphs: Contingency planning is a critical component of information protection. If  normal operations are interrupted, network managers must be able to  detect, mitigate, and recover from service disruptions while preserving  access to vital information. Therefore, a contingency plan details  emergency response, backup operations, and disaster recovery for  information systems. It is important that these plans be clearly  documented, communicated to potentially affected staff, updated to  reflect current operations, and regularly tested. Moreover, if contingency  planning controls are inadequate, even relatively minor interruptions can  result in lost or incorrectly processed data, which can lead to financial  losses, expensive recovery efforts, and inaccurate or incomplete  information.
FISMA requires each agency to develop, document, and implement plans  and procedures to ensure continuity of operations for information systems  that support the agency’s operations and assets. Both NIST and NARA  require that contingency plans be developed and tested for information  systems.
NARA developed contingency plans for 9 of the 10 systems we reviewed.  Further, NARA had tested each of the contingency plans. However, a  contingency plan was not developed for a system key to tracking physical  records. NARA identified this weakness, but had not corrected it during  the time of our review. Although all the systems in our review were tested  for contingencies, NARA has less assurance that it can appropriately  recover a key system in a timely manner from certain service disruptions.
section_title: Conclusions
paragraphs: NARA has taken important steps in implementing controls to protect the  information and systems that support its mission. However, significant  weaknesses in access controls and other information security controls  exist that impair its ability to ensure the confidentiality, integrity, and  availability of the information and systems supporting its mission. The key  reason for many of the weaknesses is that NARA has not yet fully  implemented elements of its information security program to ensure that  effective controls are established and maintained. Effective  implementation of such a program includes establishing appropriate  policies and procedures, providing security awareness training,  responding to incidents, and ensuring continuity of operations. Ensuring  that NARA implements key information security practices and controls  also requires effective management oversight and monitoring. However,  until NARA implements these controls, it will have limited assurance that  its information and information systems are adequately protected against  unauthorized access, disclosure, modification, or loss.
section_title: Recommendations for Executive Action
paragraphs: To help establish an effective information security program for NARA’s  information and information systems, we recommend that the Archivist of  the United States take the following 11 actions:    Update NARA’s system documentation and inventory to reflect accurate  FIPS 199 categorizations.
Conduct physical security risk assessments of NARA’s buildings and  facilities based on facility-level and federal requirements.
Revise NARA’s IT security methodologies, including those for access  controls, certification and accreditation, and contingency planning, to  include NIST’s minimum system control requirements.
Include inventory information and roles and responsibilities assignments  in system security plans.
Improve NARA’s training process to ensure that all required personnel  meet security awareness training requirements.
Implement a process that ensures all required NARA personnel with  significant security responsibilities meet specialized training requirements.
Test management, operational, and technical controls for all systems at  least annually.
Conduct certification testing when authorizing systems to operate.
Update remedial action plans in a timely manner and include required  resources necessary for mitigating weaknesses, scheduled completion  dates, milestones, and how weaknesses were identified.
Improve the incident tracking process to ensure that incidents are  appropriately categorized and that personnel responsible for tracking and  reporting incidents are trained.
Develop a contingency plan for the system that tracks physical records.
In a separate upcoming report with limited distribution, we plan to make  213 recommendations to enhance NARA’s access controls to address the  142 weaknesses identified during this audit.
section_title: Agency Comments and Our Evaluation
paragraphs: In providing written comments on a draft of this report (reprinted in app.  III), the Archivist of the United States stated that he was pleased with the  positive recognition of NARA’s efforts and that he generally concurred  with our recommendations. NARA also provided technical comments,  which we have incorporated as appropriate.
In addition, the Archivist in his comments disagreed with three of the  report’s findings. First, he disagreed that NARA’s risk assessments in its  systems inventory were incorrectly applied. However, our finding does not  state that the risk assessments were incorrectly applied. Rather, as we  discuss in the report, NARA system documentation and system inventories  do not consistently reflect the FIPS 199 impact levels of its systems. These  inconsistencies may reduce NARA’s assurance that adequate controls are  in place to protect its information and information systems. Thus, we  continue to believe our finding is appropriate.
Secondly, the Archivist disagreed that NARA policies and procedures were  not always consistent with NIST guidance. As we discuss in our report,  NIST states that an agency must first determine the security category of its  information systems and then apply the appropriately tailored set of  baseline security controls. However, NARA’s policy prescribed controls  based on the individual security objectives of confidentiality, integrity, and  availability instead of applying controls based on a prior determination of  the system’s impact. We believe that without first identifying the impact of  the system, NARA’s policy may not provide the information needed to  ensure that appropriate systems controls are selected that protect its  information systems. Thus, we continue to believe our finding is valid.
Lastly, the Archivist disagreed that the information owner role must be  identified in each system security plan. However, NARA’s policy as  discussed in the report outlines key individual roles and responsibilities,  including the information owner, which should be assigned for each  system. By not clearly and consistently assigning these roles, NARA  increases the risk that critical information may not be available to those  responsible for implementing system security plans. Thus, we continue to  believe our finding is valid.
As we agreed with your office, unless you publicly announce the contents  of this report earlier, we plan no further distribution of it until 30 days  from the date of this letter. At that time, we will send copies of this report  to interested congressional committees and to the Archivist of the United  States. In addition, this report will be available at no charge on the GAO  Web site at http://www.gao.gov.
If you have any questions about this report, please contact Gregory C.  Wilshusen at (202) 512-6244 or Dr. Nabajyoti Barkakati at (202) 512-4499.  We can also be reached by e-mail at wilshuseng@gao.gov or  barkakatin@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  Key contributors to this report are listed in appendix IV.
section_title: Appendix I: Objective, Scope, and Methodology
paragraphs: The objective of our review was to determine whether the National  Archives and Records Administration (NARA) has effectively implemented  appropriate information security controls to protect the confidentiality,  integrity, and availability of the information and systems that support its  mission.
To determine the effectiveness of security controls, we gained an  understanding of the overall network control environment, identified  interconnectivity and control points, and examined controls for NARA’s  networks and facilities. Using our Federal Information System Controls  Audit Manual which contains guidance for reviewing information system  controls that affect the confidentiality, integrity, and availability of  computerized information; National Security Agency guidance; National  Institute of Standards and Technology (NIST) standards and guidance; and  NARA’s policies, procedures, practices, and standards, we evaluated these  controls by  reviewing network access paths to determine if boundaries were  adequately protected; reviewing the complexity and expiration of password settings to  determine if password management was enforced;   analyzing users’ system authorizations to determine whether they had  more permission than necessary to perform their assigned functions;   observing methods for providing secure data transmissions across the  network to determine whether sensitive data were being encrypted; reviewing software security settings to determine if modifications of  sensitive or critical system resources were monitored and logged;   observing physical access controls over unclassified and classified areas  to determine if computer facilities and resources were being protected  from espionage, sabotage, damage, and theft;   examining configuration settings and access controls for routers, network  management servers, switches, and firewalls;  inspecting key servers and workstations to determine if critical patches  had been installed and/or were up to date; reviewing media handling policy, procedures, and equipment to determine  if sensitive data were cleared from digital media before media were  disposed of or reused; reviewing nondisclosure agreements at select locations to determine if  they are required for personnel with access to sensitive information; and    examining access roles and responsibilities to determine whether  incompatible functions were segregated among different individuals.
Using the requirements identified by the Federal Information Security  Management Act of 2002 (FISMA), which establishes key elements of an  agencywide information security program, and associated NIST guidelines  and NARA requirements, we evaluated the effectiveness of NARA’s  implementation of its security program by  reviewing NARA’s risk assessment process and risk assessments for 10  systems to determine whether risks and threats were documented  consistent with federal guidance;   analyzing NARA policies, procedures, practices, and standards to  determine their effectiveness in providing guidance to personnel  responsible for securing information and information systems;   analyzing security plans for 10 out of 43 systems to determine if  management, operational, and technical controls were in place or planned  and whether security plans reflected the current environment;    examining the security awareness training process for employees and  contractors to determine if they received training prior to system access;    examining training records for personnel with significant responsibilities  to determine if they received training commensurate with those  responsibilities;    analyzing NARA’s procedures and results for testing and evaluating  security controls to determine whether management, operational, and  technical controls were sufficiently tested at least annually and based on  risk;   evaluating NARA’s process to correct weaknesses and determining  whether remedial action plans complied with federal guidance; reviewing incident detection and handling policies, procedures, and  reports to determine the effectiveness of the incident handling program;   examining contingency plans for 10 systems to determine whether those  plans were developed and tested; and reviewing three IT contracts to determine if security requirements were  included.
We also discussed with key security representatives and management  officials whether information security controls were in place, adequately  designed, and operating effectively.
To establish the reliability of NARA’s computer-processed data we  performed an assessment. We evaluated the materiality of the data to our  audit objectives and proceeded to assess the data by various means  including: reviewing related documents, interviewing knowledgeable  agency officials, and reviewing internal controls. Through a combination  of methods we concluded that the data were sufficiently reliable for the  purposes of our work.
We conducted this performance audit from December 2009 to October  2010 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objective. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objective.
section_title: Appendix II: NARA Organizational Chart
section_title: Appendix III: Comments from the National Archives and Records Administration
section_title: Appendix IV: GAO Contacts and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the individuals named above, Edward Alexander, Lon Chin,  West Coile, Anjalique Lawrence, and Chris Warweg (Assistant Directors);  Gary Austin; Angela Bell; Larry Crosland; Saar Dagani; Kirk Daubenspeck;  Denise Fitzpatrick; Fatima Jahan; Mary Marshall; Sean Mays; Lee  McCracken; Jason Porter; Michael Redfern; Richard Solaski; and Jayne  Wilson made key contributions to this report.