Information Security: Agencies Need to Improve Oversight of Contractor Controls
Published: 2014-08-08T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Federal agencies often rely on contractors to operate computer systems and process information on their behalf. Federal law and policy require that agencies ensure that contractors adequately protect these systems and information.
GAO was asked to evaluate how well agencies oversee contractor-operated systems. The objectives of this report were to assess the extent to which (1) selected agencies oversee the security and privacy controls for systems that are operated by contractors on their behalf and (2) executive branch agencies with government-wide guidance and oversight responsibilities have taken steps to assist agencies in ensuring implementation of information security and privacy controls by such contractors. To do this, GAO selected six agencies based on their reported number of contractor-operated systems and two systems at each agency using a non-generalizable random sample for review, analyzed agency policies and procedures, and examined security and privacy-related artifacts for selected systems. GAO also interviewed agency officials, and reviewed federal guidance and evaluated agency FISMA submissions.
section_title: What GAO Found
paragraphs: Although the six federal agencies that GAO reviewed (the Departments of Energy (DOE), Homeland Security (DHS), State, and Transportation (DOT), the Environmental Protection Agency (EPA) and the Office of Personnel Management (OPM)) generally established security and privacy requirements and planned for assessments to determine the effectiveness of contractor implementation of controls, five of the six agencies were inconsistent in overseeing the execution and review of those assessments, resulting in security lapses. For example, in one agency, testing did not discover that background checks of contractor employees were not conducted. The following table shows the degree of implementation of oversight activities at selected agencies.
A contributing reason for these shortfalls is that agencies had not documented procedures for officials to follow in order to effectively oversee contractor performance. Until these agencies develop, document, and implement specific procedures for overseeing contractors, they will have reduced assurance that the contractors are adequately securing and protecting agency information.
The Office of Management and Budget (OMB), the National Institute of Standards and Technology, and the General Services Administration have developed guidance to assist agencies in ensuring the implementation of security and privacy controls by their contractors. However, OMB guidance to agencies for categorizing and reporting on contractor-operated systems is not clear on when an agency should identify a system as contractor-operated and therefore agencies are interpreting the guidance differently. In fiscal year 2012, inspectors general from 9 of the 24 major agencies found data reliability issues with agencies' categorization of contractor-operated systems. Without accurate information on the number of contractor-operated systems, OMB assistance to agencies to help improve their cybersecurity posture will be limited and OMB's report to Congress on the implementation of the Federal Information Security Management Act (FISMA) is not complete.
section_title: What GAO Recommends
paragraphs: GAO is recommending that five of the six selected agencies develop procedures for the oversight of contractors and that OMB clarify reporting instructions to agencies. The five agencies generally agreed with the recommendations and OMB did not provide any comments.

section_title: Letter
paragraphs: The federal government relies on information technology (IT) systems to  provide essential services affecting the health, economy, and defense of  the nation. The security of computer networks and systems, including  federal information systems, continues to be an issue of pressing concern  for the nation. We have identified the protection of federal information  systems as a government-wide high-risk area since 1997 and, in 2003,  expanded this high-risk area to include the protection of systems  supporting the nation’s critical infrastructures. Since that time, we have  issued numerous reports making recommendations to address  weaknesses in federal information security programs.
Agencies frequently use the services of contractors to operate and secure  computer systems and process information on their behalf. For fiscal year  2012, the Chief Financial Officers Act agencies reported that 33 percent  of all personnel performing IT security duties were contractors. In our  prior work,  we found that agencies identified additional risks in using  contractor-operated systems that may impact the privacy and security of  their information and systems.
The Federal Information Security Management Act of 2002 (FISMA), Privacy Act of 1974, and implementing policies and guidance from the  Office of Management and Budget (OMB) and the National Institute of  Standards and Technology (NIST), require agencies to ensure the  adequate protection of agency information, including information collected  or maintained by contractors, as well as information systems operated by  contractors on the agencies’ behalf.
As relevant here, 44 U.S.C. § 3544(a)(1)(A), (b). (1) selected agencies oversee the security and privacy controls for  systems that are operated by contractors on their behalf, and (2)  executive branch agencies with government-wide guidance and oversight  responsibilities have taken steps to assist agencies in ensuring  implementation of information security and privacy controls by such  contractors.
For our first objective, we selected six agencies (the Environmental  Protection Agency (EPA), the Departments of Energy (DOE), Homeland  Security (DHS), State, and Transportation (DOT), and the Office of  Personnel Management (OPM)) based on their reported number of  contractor operated systems and evaluated their security and privacy  policies and procedures for agency information, systems, and contractors.  At each agency, we selected two systems using a non-generalizable  random sample from a list of agency provided contractor-operated  systems that were identified as having personally identifiable information  and as either government-owned and contractor-operated and contractor- owned and contractor-operated. We evaluated how effectively the  agency’s assessments of security and privacy policies and procedures  were being implemented at each selected system. We interviewed  officials from each of the agencies’ Office of the Chief Information Officer  (CIO), procurement offices and program-level offices. We reviewed the  agencies’ respective inspector general evaluations regarding contractor  oversight and included their results where appropriate.
For our second objective, we reviewed OMB guidance and instructions,  DHS guidance and reports, reports from the Offices of Inspector General  of the 24 Chief Financial Officers Act agencies, NIST security  publications, and General Services Administration (GSA) guidance. We  conducted interviews with agency officials at OMB, DHS, NIST, and GSA  to identify how they assisted agencies with overseeing contractor  implementation of security and privacy controls. We also interviewed  officials from offices of inspectors’ general of the agencies we reviewed  for the first objective to discuss how the agencies are reporting their  inventory of systems.
We conducted this performance audit from February 2013 to July 2014 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. For more details on our  objectives, scope, and methodology, see appendix I.
subsections: section_title: Background
paragraphs: The use of IT is pervasive in the federal government as agencies have  become dependent on computerized information systems and electronic  data to carry out operations and to process, maintain, and report  information. As our past work has shown, protecting federal systems and  the information on them is essential because the loss or unauthorized  disclosure or alteration of the information can lead to serious  consequences and can result in substantial harm to individuals and the  federal government. Specifically, ineffective protection of IT systems and  information can result in  threats to national security, economic well-being, and public health  and safety;  loss or theft of resources, including money and intellectual property;  inappropriate access to and disclosure, modification, or destruction of  sensitive information; use of computer resources for unauthorized purposes or to launch an  attack on other computer systems; damage to networks and equipment; loss of public confidence; and high costs for remediation.
While some incidents can be resolved quickly and at minimal cost, others  may go unresolved and result in significant costs.
subsections: section_title: Agencies Rely on Contractors to Operate and Secure Systems
paragraphs: Federal agencies rely extensively on contractors to provide IT services  and operate systems to help carry out their missions. For example, we  reported that in fiscal year 2012, the Department of Defense obligated  approximately $360 billion for contracts for goods and services, such as  information technology and weapon systems maintenance. The ability to  contract for technology services can allow an agency to obtain or offer  enhanced services without the cost of owning the required technology or  maintaining the human capital required to deploy and operate it.  Specifically, contractors and their employees provide services and  systems to agencies at agency and contractor facilities, directly and by  remote access. Services can include computer and telecommunication  systems and services, and testing, quality control, installation, and  operation of computer equipment.
section_title: Federal Laws, Regulations, and Guidance Provide a Framework for Protecting the Privacy and Security of Information and Systems
paragraphs: Federal laws require agencies to protect the privacy and security of  federal data and information systems. To help protect against threats to  federal systems, FISMA sets forth a comprehensive framework for  ensuring the effectiveness of information security controls over  information resources that support federal operations and assets,  including those operated by contractors on behalf of the agency. It  requires each agency to develop, document, and implement an  information security program that includes the following components: periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems; policies and procedures that are (1) are based on risk assessments,  (2) cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements;  subordinate plans for providing adequate information security for  networks, facilities, and systems or group of information systems, as  appropriate;  security awareness training to inform personnel, including contractors,  of information security risks and of their responsibilities in complying  with agency policies and procedures designed to reduce these risks,  as well as training personnel with significant security responsibilities  for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of  information systems; a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency.
Under FISMA, each agency CIO has the responsibility to ensure that  agency information and information systems, including those operated by  contractors, are being protected under the agency’s information security  program. In addition, OMB’s annual FISMA reporting instructions require  agencies to develop policies and procedures for agency officials to follow  when performing oversight of the implementation of security and privacy  controls by contractors.
FISMA requires each agency to have an annual independent evaluation  of its information security program and practices, including controls  testing and compliance assessment. OMB guidance specifically requires  each agency inspector general, or other independent auditor, to perform  the evaluation, including the effectiveness of the agency’s contractor  oversight. Additionally, inspectors general are to evaluate agency efforts  in providing oversight of contractor employees who have privileged  access to federal data and information systems.
In addition to establishing responsibilities for agencies, FISMA assigns  specific information security responsibilities to OMB and NIST:
OMB is to develop and oversee the implementation of policies,  principles, standards, and guidelines on information security in federal  agencies. It is also responsible for reviewing, at least annually, and  approving or disapproving agency information security programs.  Further, OMB is to report annually to Congress on the implementation  of FISMA by the agencies.
NIST’s responsibilities include developing security standards and  guidelines for agencies (other than for national security systems) that  include standards for categorizing information and information  systems according to ranges of risk levels, minimum security  requirements for information and information systems in risk  categories, guidelines for detection and handling of information  security incidents, and guidelines for identifying an information system  as a national security system.
The Privacy Act of 1974 limits how federal agencies collect, disclose, or  use personal information. Under this act, agencies are to, among other  things, establish appropriate safeguards to ensure the security and  confidentiality of personal information maintained in a system of records  and protect it against anticipated security or integrity threats or hazards.  The Privacy Act’s requirements also apply to government contractors and  contractor employees who have access to or maintain agency systems of  records that contain personally identifiable information. The Privacy Act  requires that when agencies establish or make changes to a system of  records, they must notify the public through a system-of-records notice in  the Federal Register which includes the system safeguards for the  security and confidentiality of personal information.
Pub. L. No. 107-347 § 208 (Dec. 17, 2002); 44 U.S.C. § 3501 note. agencies must conduct PIAs before developing or procuring information  technology that collects, maintains, or disseminates information that is in  a personally identifiable form. In conducting PIAs, agencies are to ensure  that the handling of the information conforms to applicable privacy legal  requirements, determine risks, and examine and evaluate protections and  alternative processes for handling information to mitigate potential privacy  risks.
section_title: Agency Assessments of Contractor-Operated Systems are Designed to Ensure that Federal Requirements are Met
paragraphs: To ensure that contractor-operated systems meet federal information  security and privacy requirements, the Federal Acquisition Regulation (FAR) requires that agency acquisition planning for IT comply with the  information technology security requirements in FISMA, OMB’s  implementing policies including Appendix III of OMB Circular A-130, and  NIST guidance and standards. The FAR addresses application of the  Privacy Act to contractors at subpart 24.1, Protection of Individual  Privacy.
NIST Special Publications 800-53 and 800-53A guide agencies in  selecting security and privacy controls for systems and assessing them to  ensure that the selected controls are in place and functioning as  expected.   Additional NIST special publications on IT security services  and risk management (Special Publications 800-35 and 800-37) identify  several key activities important to contractor oversight for assessing the  security and privacy controls of information systems. The key activities  and the steps included in each are shown in table 3.
The FAR establishes uniform policies and procedures for acquisition of supplies and  services by executive agencies. The FAR and agency supplements are codified in title 48  of the Code of Federal Regulations. As relevant here, the FAR’s acquisition planning  requirements for IT security are at 48 C.F.R. § 7.103(w). See also, FAR §  7.105(b)(16)(Government-furnished information) and (18)(Security considerations).
NIST Special Publication 800-53 Rev. 4, Security and Privacy Controls for Federal  Information Systems and Organizations, (Gaithersburg, MD: Apr. 2013) and NIST Special  Publication 800-53A, Guide for Assessing the Security Controls in Federal Information  Systems and Organizations, (Gaithersburg, MD: Jun. 2010).
section_title: GAO has Previously Reported on Agencies’ Oversight of Contractors
paragraphs: In April 2005, we reported on federal agencies’ implementation of  FISMA requirements and their oversight of contractors and others with  privileged access to federal data and systems. We determined that,  although most agencies reported having written policies that addressed  information security for contractor-provided IT services and systems, few  had established specific policies for overseeing the information security  practices of contractors and contractor employees to ensure compliance  with contract requirements and agency information security policies. We  concluded that, without specific oversight policies establishing when and  how agencies will review contractor-operated systems, officials  responsible for the systems may not be taking sufficient action to ensure  that security requirements are being met. We recommended, among  other things, that the Director of OMB ensure that federal agencies  develop policies for ensuring the information security of contractors and  other users with privileged access to federal data. Subsequently OMB  modified its instructions to better ensure that federal agencies develop  policies for ensuring the information security provided by contractor  employees.
section_title: Agency Oversight of Contractor-Operated Systems Was Not Always Consistent
paragraphs: Under FISMA, each agency CIO has the responsibility to ensure that  agency information and information systems, including those operated by  contractors, are being protected under the agency’s information security  program. In addition, OMB’s annual FISMA reporting instructions require  agencies to develop policies and procedures for agency officials to follow  when performing oversight of the implementation of security and privacy  controls by contractors. CIO oversight of the agency’s information security  program provides agency officials assurance that they are protecting  sensitive agency information. According to NIST, assessment of security  and privacy controls is a key element of security program oversight.
While the six agencies we reviewed generally established security and  privacy requirements for contractors to follow and prepared for  assessments to determine the effectiveness of contractor implementation  of controls, five of the six were inconsistent in overseeing the execution  and review of those assessments. Table 4 details the degree of  implementation of oversight activities for the selected systems at each  agency.
While agencies performed two of the eight key steps in all cases, most  were inconsistent in performing the remaining steps for the oversight of  the selected contractor-operated systems. Specifically:
Communicate requirements to contractors. Four of the six agencies  (DOE, DHS, EPA, and OPM) communicated security and privacy  requirements to contractors in contracts for the systems we reviewed.  For example, a contract for one system at EPA specifically required  the contractor to comply with the EPA information security policy. Two  of the six agencies (DOT and State) did not always communicate  security and privacy requirements to contractors in the contracts for  agency systems. NIST guidance states that security requirements  should be stated explicitly or by reference in contracts. However,  while State’s departmental policies include references regarding  contractor requirements for protecting personally identifiable  information and system authorization, the contract for one system that  we reviewed did not contain language that communicated these  requirements. Furthermore, while the contract for one of the systems  at DOT was modified to include requirements for background  investigations, there was no language included that communicated  agency security and privacy requirements. Officials for both agencies  were not able to explain why this language was not included in the  contracts. Without specific security requirements in the contract, these  two systems are at an increased risk that contractors may not  understand the requirements that they are expected to implement or  cannot be held to the security and privacy requirements during  contract performance.
Select and document security and privacy controls. All 12 of the  systems that we reviewed documented the security and privacy  controls that were expected to be implemented for the system within  the system security plan. According to NIST Special Publication 800- 37, system security plans are intended to provide an overview of the  security requirements for the system and describe the security  controls in place or planned for meeting those requirements. Each  agency supported the selection of controls by documenting privacy  risks and impacts to the systems we reviewed within a PIA, as called  for when systems contain personally identifiable information.
Select an independent assessor. Five of the six agencies ensured that  assessors used for systems we reviewed were independent, as  required by NIST. For moderate impact information systems and  higher, such as the ones that we reviewed, NIST states that an  independent third party reviewer should be used for the assessment  to ensure that the review is unbiased. For example, for both systems  we reviewed at OPM, the agency used a different contractor to assess  the system and system officials took steps to verify that the assessor  was independent. However, one agency, State, did not ensure that  the assessors used for both systems we reviewed were independent.  State officials allowed the contractor to select the assessor for both  systems we reviewed and did not take steps to verify the assessor’s  independence. State officials stated that they believe it was not their  responsibility to ensure the independence of the assessors for the  particular systems. As a result, the agency has reduced assurance  that assessments were complete and unbiased.
Develop a test plan. Five of the six agencies adequately documented  test plans for the assessments of the two systems we reviewed at  each agency. These plans documented the controls to be tested and  appropriate assessment procedures. NIST Special Publication 800- 53A states that test plans are to document the objectives for the  security control assessment and provide a detailed road map of how  the assessors are to test the information security and privacy controls  for the system. One of the six agencies (DOE) did not document  which controls from the system security plan were to be tested and  the assessment procedures that were to be followed for one system  as the officials could not locate the system test plan. DOE officials  stated that the computer housing the information became corrupted  and the detailed test plan could therefore not be provided.stated that, in response to our audit, they now plan to expedite the  development of a test plan to be executed this year. Without a  detailed test plan, agency officials have reduced assurance that the  selected controls were tested and that the correct tests were  executed.
Execute the test plan. One of the six agencies (DHS) effectively  executed the test plan for the two systems we reviewed. For both of  its systems, the controls from the test plan, were effectively tested,  and for areas such as background investigation and contingency plan  training evidence was provided showing that all of the contractors  operating the system had received an investigation or training. NIST  guidance calls for agencies to ensure that the test plan is  appropriately executed during the assessment process.
However, the system assessments that were performed by five of the  six agencies (DOE, DOT, EPA, OPM, and State) were not always  effective. For example, DOT and State did not always ensure that  system assessments evaluated the extent to which background  investigations had been conducted for contractor employees. Instead,  the agencies relied on agency-wide testing of personnel security as a  common control. However, agency-wide testing was not  comprehensive enough to identify lapses that we found regarding  background investigationssystems. Specifically, for one of the DOT systems we reviewed,   for contractor personnel working on these  department officials responsible for system testing had not evaluated  whether the seven contractor employees working on the system had  the required background investigation. When they did so in response  to our audit, they found that three of them did not. Officials stated that  they subsequently removed system access rights for the three  contractor employees until their background investigations had been  completed. For the department’s other selected system, DOT  officials did not have evidence that 44 of 133 contractor employees  had undergone a current background investigation.
For the two State systems we reviewed, department officials  responsible for these systems stated that they did not believe that it  was necessary for them to check whether contractor employees had  undergone a background investigation. However, the system security  plans for both State systems had documented the selection of  background investigations as applicable security controls, therefore  calling for them to be included in the scope of testing. By not testing  that all contractor employees operating a system have had an  appropriate background investigation completed, agency officials lack  assurance that contractor employees can be trusted with access to  government information and systems.
Furthermore, for 8 of the 12 systems that we reviewed, the agencies  did not always ensure that system assessments accurately evaluated  the extent to which contractor employees had completed contingency  plan training as required. NIST guidance states that anyone with  responsibilities for implementing the contingency plan should receive  regular training on their role. However, DOE, DOT, EPA, OPM and  State officials were unable to demonstrate that contractor employees  had received the necessary training despite assessment results that  stated they had. Additionally, DOT officials were unable to identify  whether several staff members listed in the contingency plan of one  system were federal employees or contractor personnel. Overseeing  that key contractor staff had taken or completed the contingency plan  training would provide increased assurance that contractor employees  are familiar with their roles and responsibilities under the contingency  plan.
Recommend remediation actions. All 12 of the system assessments  that we reviewed produced a report showing recommendations from  the assessor. NIST states that, since results of the security control  assessment ultimately influence the content of the system security  plan and the plan of action and milestones, agency officials should  review the security assessment report to determine the appropriate  steps required to correct weaknesses and deficiencies identified  during the assessment. Furthermore, assessors’ recommendations in  the security assessment report are an important input into agency  officials’ risk-based decisions on addressing weaknesses. All 12 of the  system assessments that we reviewed included recommendations to  address weaknesses.
Review the assessment results. Three of the six agencies (DHS, EPA,  and OPM) adequately reviewed assessment results, ensuring that all  of the controls selected for the systems and the evaluation methods  used for the controls were included. However, three of the six  agencies (DOT, DOE, and State) did not adequately review the  assessment results. For one system at DOT, DOE, and State,  documentation provided by agency officials showed that a thorough  review had not occurred by the authorizing official. NIST states that  the systems authorizing official or designated representative is to  assess the current security state of the system or the common  controls inherited by the system. For the system at DOT, the test  evidence for the media protection and physical security controls (25  total controls) that was documented, reviewed, and accepted was  from a different DOT system. DOT officials confirmed that these  controls had not been sufficiently tested and that they would test them  as part of their next system assessment. At DOE, officials were able  to provide the executive summary of the test results but could not  show that the full test results had been reviewed. Agency officials  stated that the computer housing the information became corrupted  and the detailed test results could not be provided. In addition, at  State, a system security control assessment did not document that 69  of the systems’ controls were tested, and the assessment showed that  the results were reviewed and accepted. State officials were unable to  provide a reason for this lapse. Without properly reviewing the  assessment results, agency officials may lack assurance that all of the  controls selected for a system are properly tested.
Develop a plan of action and milestones for remediation of  weaknesses. Three of the six agencies (OPM, DHS, and DOE) for  both systems we reviewed maintained POA&M that included all of the  NIST elements, such as estimated completion dates, resource  allocation and issue identification. For example, for one system we  reviewed at OPM, the POA&M is maintained by agency officials using  a software application that includes the elements required by NIST.  However, three of the six agencies (DOT, State, and EPA) did not  always complete or update POA&Ms for their contractor-operated  systems. Specifically, the POA&Ms for one of the two systems we  reviewed at State and DOT were missing information such as  estimated completion dates and resources that were assigned to  resolution. Additionally, State did not include all of the weaknesses  identified in the assessment report within the POA&M for the second  system we reviewed. State officials stated that those weaknesses  should have been captured in the POA&M. EPA could not provide an  updated POA&M for one of the two systems we reviewed. Without  complete or up-to-date POA&Ms, agencies increase the risk that  identified weaknesses will not be resolved in a timely fashion.
subsections: section_title: Selected Agencies Have Not Developed Procedures for Overseeing the Privacy and Security of Federal Information on Contractor- Operated Systems
paragraphs: The responsibility for adequately mitigating risks arising from the use of  contractor-operated systems remains with the agency. OMB’s annual  FISMA reporting instructions require agencies to develop policies for  information security oversight of contractors and the FAR, in its  procedures for acquisition planning, requires agencies to ensure that  information technology acquisitions comply with FISMA, OMB’s  implementing policies, and NIST guidance and standards. Further, NIST  SP 800-53 states that agencies should develop, document and implement  a process that provides oversight to ensure that agency testing of security  and privacy controls is planned and conducted consistent with  organizational priorities.
A contributing reason for shortfalls identified in agency oversight of  contractors was that agencies had not documented procedures to direct  officials in performing such oversight activities effectively. For example,  system officials for one system at DOT that accepted assessment results  for 25 controls from the wrong system; the department did not have  procedures in place to direct officials on how to effectively review such  test results.
According to the Office of the CIO officials we interviewed from each of  the six selected agencies, all information security and privacy policies and  procedures of each agency apply to their federal employees and systems  as well as to contractors, contractor employees, and contractor-operated  systems, and the system assessment process is intended to provide  assurance that these policies and procedures are being implemented.  However, as described in the previous section, we found inconsistencies  in the oversight of contractor-operated systems at five of the six agencies;  none of the agencies had procedures in place to direct officials in how to  conduct such oversight. Such inconsistencies may have been mitigated if  procedures had been created, documented and implemented. For  example, agency officials reviewing system assessment results could  refer to a procedure outlining the necessary actions for an effective  review of an assessment conducted by contractors. As a result, agency  officials have less assurance that oversight activities are being performed  consistently and effectively over all of their contractor-operated systems  and weaknesses may go undetected and unresolved, such as having  contractor employees operate a system without undergoing a background  investigation.
section_title: Government-wide Guidance for Contractor-Operated Systems Assists Agencies, but OMB Guidance Needs Clarification
paragraphs: In fulfilling its responsibilities to develop guidance and oversee the  implementation of FISMA, OMB has issued guidance for agencies to  ensure that contractors and contractor employees meet agency  information security and privacy requirements. Specifically, OMB issues  annual FISMA reporting instructions to guide agencies as they report on  their security requirements. The instructions state that agencies are  responsible for ensuring that systems operated by contractors meet  FISMA information security requirements. The OMB instructions also  state that systems operated by contractors are to be reported as part of  the agency’s system inventory, tested on an annual basis, and reviewed  appropriately. OMB collects the information from agencies on their  implementation of FISMA, and then provides a summary of the data in an  annual report to Congress.
Further, OMB has developed guidance over several years to assist  agencies in assessing their contractors’ performance. The guidance  ranges from providing agencies with overarching requirements for  managing contractors to requiring agency officials with acquisition and  procurement responsibilities to take specific actions. Examples of OMB  guidance for agencies that address contractor management are shown in  table 5.
OMB has also tasked DHS with certain responsibilities assisting  government-wide efforts to provide adequate, risk based, and cost- effective cybersecurity. OMB and DHS have met with agency CIOs,  chief information security officers, and other agency officials to discuss  and assist in developing focused strategies for improving their agency’s  cybersecurity posture. OMB officials from the Office of E-Government and  Information Technology stated that agency contractor oversight for  contractor-operated systems is discussed as needed at these meetings  and that assisting agencies in implementing OMB guidance and  instructions provides greater protections for all of an agency’s systems,  including contractor-operated systems. OMB officials from the same office  stated that these meetings allow them to conduct outreach and education  to assist agencies in understanding their guidance as necessary.
subsections: section_title: OMB Guidance is Not Clear on When Systems Should Be Identified and Reported as Contractor- Operated
paragraphs: OMB guidance to agencies for categorizing and reporting contractor- operated systems does not clearly define what a contractor-operated  system is and consequently, agencies are interpreting the guidance  differently. FISMA assigns OMB responsibilities to develop and oversee  the implementation of policies, principles, standards, and guidelines on  information security in federal agencies. Guidance provided as part of  OMB’s annual FISMA reporting instructions identifies several types of  contractor relationships an agency may have in using a contractor for a  system.  However, it does not specify which agency systems that have  contractor relationships should be categorized as contractor-operated.  We and the inspectors general have found that not all agencies are  interpreting this guidance in the same manner. Specifically, two of the six  agencies we reviewed did not report all of their systems that are operated  by contractors on their behalf as “contractor-operated” in their FISMA  submissions. For example, CIO officials from the State Department stated  that the number of contractor-operated systems the department reported  as part of its 2012 FISMA submission did not include all systems that are  operated by contractors. Rather, officials stated that the department only  reported those systems that are both owned and operated by contractors  by this label and identifies systems that are government-owned as  “agency-operated” even when contractors operate the system on behalf  of the department. Conversely, DHS officials stated that it reports  systems as “contractor operated” only when they are government-owned  but operated by contractors. DHS systems that are both owned and  operated by contractors are designated by a third category known as an  “external information system.” Those systems are not included in either  the list of department’s agency-operated systems or contractor-operated  systems.
Additionally, in their fiscal year 2012 annual FISMA reports, inspectors  general from 9 of the 24 major agencies found data reliability issues with  their agencies’ categorization of contractor-operated systems.example, DOT’s Inspector General reported that 24 of the Department’s  60 information systems were owned and operated by a contractor, but  only 4 were categorized as being contractor-operated by the department.
OMB officials from the Office of E-Government and Information  Technology stated that they believe the current guidance is sufficient to  assist agencies in categorizing and reporting contractor-operated  systems. OMB officials stated that, while they would not be able to  identify all of the types of relationships that agencies have with  contractors, agencies can refer to the guidance contained within the  FISMA reporting instructions and its outline of five different categories of  relationships that agencies may have with contractors operating systems  or processing information on the agencies’ behalf.
Nevertheless, the inconsistent implementation of OMB’s reporting  guidance by agencies in reporting the number of contractor-operated  systems demonstrates that existing outreach and education efforts during  face-to-face meetings with agency information security officials are not  always resulting in accurate reporting of agencies’ reliance on contractors  to operate systems and process government information on their behalf.  Consequently, agencies are not reporting all of their contractor-operated  systems in their FISMA submissions, the information is not complete  enough to provide OMB with an accurate representation of the number of  contractor-operated systems within the government, and OMB’s report to  Congress on the implementation of FISMA is not complete. Without  complete information about contractor-operated systems, OMB and DHS  may limit their ability to assist agencies in improving their cybersecurity  postures and Congress will not have complete information on the  implementation of FISMA.
section_title: NIST and GSA Provide Guidance to Agencies for Addressing Security and Privacy Requirements for Contractor-Operated Systems
paragraphs: FISMA requires NIST to develop security standards and guidelines for  agencies (other than national security systems), including when  information and information systems are used or operated by a federal  contractor on behalf of an agency. OMB Circular A-130 states that GSA  should provide agencies with security guidance when acquiring  information technology products or services.
To meet its FISMA requirements, NIST has issued guidance for agencies  to follow in overseeing contractors as they operate, use, and access  government information and information systems. It has produced  numerous information security standards and guidelines and has updated  existing information security publications to assist agencies in developing  and implementing an information security program that manages risks,  including those risks incurred through the use of contractors. For  example, in April 2013, NIST released its fourth update of a key federal  government computer security control guide, Special Publication 800-53:  Security and Privacy Controls for Federal Information Systems and  Organizations, which contains an external service providers section that  has requirements for agencies to ensure that contractors meet the same  requirements that agencies adhere to and recommends that agencies  incorporate oversight controls such as establishing personnel security  requirements, requiring third-party providers to notify the agency of  personnel transfers, and monitoring provider compliance. Further, the  guide includes an appendix on identifying and implementing controls for  protecting privacy within an organization, including contractors.
Further, NIST officials stated that the risks incurred from utilizing  contractors should be addressed by incorporating the risk management  framework as part of the terms and conditions of the contract and that  agencies can specify the security controls for which the contractor must  implement and require appropriate evidence to demonstrate that they  effectively implemented the specified controls. The risk management  framework, specified in NIST Special Publication 800-37, provides a  process that integrates information security and risk management  activities into the system development life cycle.
GSA, in meeting its responsibilities under OMB Circular A-130 issued  guidance, templates, and established pre-negotiated contracts for  agencies using contractors to maintain agency information and systems.
GSA has also published an acquisition manual to assist agencies when  they choose to create their own contracts.
Additionally, GSA has negotiated contracts for products and services to  assist agencies transitioning to cloud computing services. Cloud  computing services are being managed through FedRAMP, a  government-wide program to provide joint authorization and continuous  security monitoring services for all federal agencies. GSA creates  standardized FedRAMP templates for contract language and security  assessments, among other things, and sample service level agreements  for use in cloud service acquisitions.
section_title: Conclusions
paragraphs: The six agencies reviewed made efforts to assess the implementation of  security and privacy controls for selected contractor-operated systems.  The agencies generally had established security and privacy  requirements for contractors to follow and prepared for assessments to  determine the effectiveness of contractor implementation of controls.  However, oversight of the execution and review of assessments of  contractor-operated systems was not consistent at five of the six agencies  we reviewed. Specifically, agencies did not always prepare, execute, and  review assessments of their contractor-operated systems. A contributing  reason for these shortfalls is that agencies had not documented  procedures for officials to follow in order to perform such oversight of  contractors effectively. Until these agencies develop, document and  implement specific procedures for overseeing contractors, they will have  reduced assurance that the contractors are adequately securing and  protecting agency information, including of the extent to which contractors  have undergone background investigations.
OMB, NIST, and GSA have provided agencies guidance to assist in  implementing privacy and security controls for contractor-operated  systems. In addition, OMB and DHS are taking actions to assist agencies  in planning to improve their cybersecurity posture. However, the lack of  clear instructions to agencies for reporting contractor-operated systems  has contributed to incomplete information regarding the number of  contractor-operated systems within the government. Without complete  information, OMB and DHS assistance to agencies for improving their  cybersecurity postures is limited and Congress will not have complete  information on the implementation of FISMA.
section_title: Recommendations for Executive Action
paragraphs: To ensure that the privacy and security controls of contractor-operated  systems are being properly overseen, we are making 15  recommendations to five selected agencies.
We recommend that the Secretary of Energy develop, document, and  implement oversight procedures for ensuring that, for each contractor- operated system: a system test plan is developed, a system test is fully executed, and test results are reviewed by agency officials.
We recommend that the Secretary of State develop, document, and  implement oversight procedures for ensuring that, for each contractor- operated system: an independent assessor is selected to assess the system, a system test is fully executed, test results are reviewed by agency officials, and plans of action and milestones with estimated completion dates and  security and privacy requirements are communicated to contractors,  resources assigned for resolution are maintained.
We recommend that the Secretary of Transportation develop, document,  and implement oversight procedures for ensuring that, for each  contractor-operated system: a system test is fully executed, test results are reviewed by agency officials, and plans of action and milestones with estimated completion dates and  security and privacy requirements are communicated to contractors,  resources assigned to resolution are maintained.
We recommend that the Administrator of the Environmental Protection  Agency develop, document, and implement oversight procedures for  ensuring that, for each contractor-operated system: a system test is fully executed and plans of action and milestones with estimated completion dates and  resources assigned for resolution are maintained.
We recommend that the Director of the Office of Personnel Management  develop, document, and implement oversight procedures for ensuring that  a system test is fully executed for each contractor-operated system.
To be able to effectively assist agencies with their contractor oversight  programs, we recommend that the Director of the Office of Management  and Budget, in collaboration with the Secretary of Homeland Security  develop and clarify reporting guidance to agencies for annually reporting  the number of contractor-operated systems.
section_title: Agency Comments and Our Evaluation
paragraphs: We received comments on a draft of this report from five of the six  agencies to which we made recommendations. We requested comments  from the Office of Management and Budget, but none were provided. The  Departments of Energy, State, and Transportation, the Environmental  Protection Agency and the Office of Personnel Management, generally  agreed with our recommendations. A summary of their comments and our  responses, where appropriate, are provided below.
In written comments, the Chief Information Officer for DOE stated that  the department is working to align with the recommendations. For the  one system where the department could not produce the test plan or  show evidence that the plan had been executed, the department has  targeted that system for a new security test and evaluation. DOE’s full  comments are provided in appendix II.
In written comments, the acting Comptroller of the Department of  State stated that the department agrees with our recommendations  and is planning to develop, document, and implement oversight  procedures for each contractor-operated, contractor-owned system.  Additionally, he stated that department entities will seek to ensure the  privacy and security controls of all contractor-operated systems.  State’s comments are provided in appendix III.
The Deputy Director of Audit Relations from DOT stated via e-mail  that the department agrees to consider our recommendations. We  continue to believe that the department needs to develop, document,  and implement oversight procedures for each contractor-operated  system. system had not been updated by EPA since 2011. As a result of this  information, we have modified the report and recommendation as  appropriate. EPA’s comments are provided in appendix IV.
In written comments, the OPM Chief Information Officer concurred  with our recommendation and stated that OPM will review its policies  and procedures to further enhance OPM’s oversight of contractor- operated systems. OPM’s comments are provided in appendix V.
In addition, the three agencies covered by our review that did not receive  recommendations also reviewed our draft. In written comments DHS’s  Director of the Departmental GAO-OIG Liaison Office stated that although  the Department did not receive a recommendation in this report, it will  collaborate with OMB to update the FISMA guidance in support of our  recommendation to OMB. DHS’s comments are provided in appendix VI.  The other two agencies—GSA and NIST—responded via e-mail that they  had no comment on the report through a representative of GSA’s GAO/IG  Audit Response Division  and a representative of NIST’s Management  and Organization Division. We also received technical comments from the  Department of State, which we addressed as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  Administrators of the Environmental Protection Agency and the General  Services Administration, the Directors of the Office of Management and  Budget and the Office of Personnel Management, the Secretaries of  Energy, Homeland Security, State, and Transportation, and other  interested parties. In addition, this report will be available at no charge on  the GAO website at http://www.gao.gov.
If you have any questions regarding this report, please contact me at  (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Key contributors to this report are listed in appendix VII.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to assess the extent to which (1) selected agencies  oversee the security and privacy controls for systems that are operated  by contractors on their behalf and (2) executive branch agencies with  government wide guidance and oversight responsibilities have taken  steps to assist agencies in ensuring implementation of information  security and privacy controls by contractors.
For our first objective, we selected a non-generalizable sample of six  Chief Financial Officers Act agencies. The six agencies selected were the  Departments of Energy, Homeland Security, State, and Transportation;  the Environmental Protection Agency; and the Office of Personnel  Management. We selected these 6 agencies based on the number of  contractor operated systems reported by the 24 Chief Financial Officer  Act agencies from fiscal year 2011 Federal Information Security  Management Act (FISMA) data. Specifically, we identified the eight  agencies with the largest reported number of contractor-operated  systems as high, the next eight agencies as medium, and the last eight  agencies as low. We then selected the top two from the high, medium,  and low groupings in order to review agencies that had a reported range  in the number of contractor operated systems.
To gain insight into the six agencies’ practices for protecting the security  and privacy of information and systems, we interviewed officials and  reviewed documentation regarding their policies and procedures for  overseeing contractor privacy and security practices, including reviewing  each agency’s policies and procedures for identifying risks and  vulnerabilities, providing security awareness training to personnel with  significant information security responsibilities, developing plans of action  and milestones, developing incident response plans, and testing of  system security controls. We conducted interviews with officials from  each agency’s Office of the Chief Information Officer, Privacy Office,  procurement office, as well as system owners to understand how they  oversee the implementation of the Federal Acquisition Regulation (FAR),  FISMA, and Privacy Act requirements, relevant OMB policies, National  Institute of Standards and Technology (NIST) guidance, and agency-wide  and system-level policies and procedures.
To understand how well agencies’ were overseeing the implementation of  agency requirements by contractors, we reviewed oversight efforts by  agencies at the system level. We selected two systems at each agency  using a non-generalizable random sample from a list of agency provided  contractor-operated systems that were identified as having personally  identifiable information and as either government-owned and contractor- operated and contractor-owned and contractor-operated. We examined  whether the agencies for each selected system implemented oversight  over key elements of federal requirements and guidance such as the  FAR; FISMA; the Privacy Act, and NIST and Office of Management and  Budget (OMB) guidance. The key elements were communicating  requirements to contractors, selecting and documenting security controls,  selecting an independent assessor, developing a test plan, executing the  test plan, recommending remediation actions, reviewing results, and  developing a plan of action and milestones. We also assessed whether  agency officials at selected information systems implemented policies and  procedures set forth by the agency, including contractor oversight  activities performed by the responsible agency official.
For our second objective, we reviewed requirements and guidance  provided by OMB, NIST, and the General Services Administration (GSA)  to agencies used to assist them in conducting contractor oversight. We  interviewed DHS, GSA, OMB, and NIST officials regarding the policies  and procedures for overseeing contactor privacy and security, and the  activities taken to provide assistance to agencies regarding oversight of  contractor-operated systems. We analyzed agency responses to OMB  and DHS guidance regarding contractor-operated systems. We also  reviewed inspectors general FISMA reports to assess agencies progress  in meeting FISMA reporting requirements related to contractor security,  including the reliability of the reporting of contractor-operated systems by  agencies. We also interviewed officials of inspectors’ general of the  agencies we reviewed for the first objective to discuss how the agency’s  are reporting their inventory of systems.
We conducted this performance audit from February 2013 to July 2014 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe the  evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of Energy
section_title: Appendix III: Comments from the Department of State
section_title: Appendix IV: Comments from the Environmental Protection Agency
section_title: Appendix V: Comments from the Office of Personnel Management
section_title: Appendix VI: Comments from the Department of Homeland Security
section_title: Appendix VII: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, the following staff also made  key contributions to the report: Nicholas Marinos (assistant director),  Melina Asencio, Sher’rie Bacon, Kathleen Feild, Nancy Glover, Wilfred  Holloway, Thomas Johnson, David Plocher, and Jeffrey Woodward.