Information Security: Selected Departments Need to Address Challenges in Implementing Statutory Requirements
Published: 2007-08-31T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Federal Information Security Management Act of 2002 (FISMA) strengthened security requirements by, among other things, requiring federal agencies to establish programs to provide cost-effective security for information and information systems. In overseeing FISMA implementation, the Office of Management and Budget (OMB) has established supporting processes and reporting requirements. However, 4 years into implementation of the act, agencies have not yet fully implemented key provisions. In this context, GAO determined what challenges or obstacles inhibit the implementation of the information security provisions of FISMA at the Departments of Defense, Homeland Security, Justice, and State. To do this, GAO reviewed and analyzed department policies, procedures, and reports related to department information security programs and interviewed agency officials.
section_title: What GAO Found
paragraphs: Defense, Homeland Security, Justice, and State face challenges in implementing key information security control activities required by FISMA and by OMB in its oversight role. These activities include creating and maintaining an inventory of major systems, implementing common security configurations, ensuring that staff receive information security training, testing and evaluating controls, taking remedial actions where deficiencies are found, and certifying and accrediting systems for operation. The four departments were challenged in several of these areas. For example, Defense is challenged in developing a complete FISMA inventory of systems because it has different definitions of what constitutes a "system." As another example, Homeland Security reported that the tool it uses to report security training counts each course taken, instead of tracking that an individual has taken a specialized course. As a result, the department lacks assurance that all users have received appropriate training. Until the departments address their challenges and fully implement effective departmentwide information security programs, increased risk exists that they will not be able to effectively protect the confidentiality, integrity, and availability of their information and information systems.

section_title: Letter
paragraphs: The Federal Information Security Management Act of 2002 (FISMA)  The Federal Information Security Management Act of 2002 (FISMA)  strengthened security requirements by, among other things, requiring  strengthened security requirements by, among other things, requiring  departments to establish agencywide programs to provide cost-effective  departments to establish agencywide programs to provide cost-effective  security for information and information systems. Information security is a  security for information and information systems. Information security is a  critical consideration for any organization that depends on information  critical consideration for any organization that depends on information  systems and networks to carry out its mission or business. It is especially  systems and networks to carry out its mission or business. It is especially  important for federal departments where maintaining the public trust is  important for federal departments where maintaining the public trust is  essential.  essential.
In this context, our objective in this report was to determine the  In this context, our objective in this report was to determine the  challenges or obstacles that inhibit the implementation of the information  challenges or obstacles that inhibit the implementation of the information  security provisions of FISMA at the Departments of Defense, Homeland  security provisions of FISMA at the Departments of Defense, Homeland  Security, Justice, and State. To achieve our objective, we analyzed various  Security, Justice, and State. To achieve our objective, we analyzed various  department policies and procedures and examined agency and inspectors  department policies and procedures and examined agency and inspectors  general (IG) reports related to their information security programs. We  general (IG) reports related to their information security programs. We  also interviewed information security program officials from each  also interviewed information security program officials from each  department and selected component agencies of the departments.   department and selected component agencies of the departments.
We performed our work in Washington, D.C., from July 2006 through   We performed our work in Washington, D.C., from July 2006 through   May 2007 in accordance with generally accepted government auditing  May 2007 in accordance with generally accepted government auditing  standards. See appendix I for additional details on our objective, scope,  standards. See appendix I for additional details on our objective, scope,  and methodology.  and methodology.
subsections: section_title: Background
paragraphs: Federal agencies rely extensively on computerized information systems  and electronic data to carry out their missions. The security of these  systems and data is essential to prevent data tampering, disruptions in  critical operations, fraud, and inappropriate disclosure of sensitive  information. Protecting federal computer systems and the systems that  support critical infrastructures has never been more important, owing to  the ease of obtaining and using hacking tools, the steady advances in the  sophistication and effectiveness of attack technology, and the emergence  of new and more destructive attacks. Without proper safeguards, there is  enormous risk that individuals and groups with malicious intent may  intrude into inadequately protected systems and use this access to obtain  sensitive information, commit fraud, disrupt operations, or launch attacks  against other computer systems and networks.
subsections: section_title: Federal Law and Policy Establish Federal Information Security Requirements
paragraphs: Enacted into law on December 17, 2002, as Title III of the E-Government  Act of 2002, FISMA authorized and strengthened information security  program, evaluation, and reporting requirements. It assigns specific  responsibilities to agency heads, chief information officers (CIO), and IGs.  It also assigns OMB and the National Institute of Standards and  Technology (NIST) with responsibilities with regard to oversight and  guidance. Among other things, OMB is responsible for overseeing agency  information security policies and practices, including developing and  overseeing guidance on information security and overseeing compliance.  NIST is tasked with developing standards and guidance for  implementation of FISMA requirements by federal agencies. However, 4  years into the implementation of FISMA, many agencies continue to  exhibit weaknesses in carrying out the act’s requirements.
Overall, FISMA requires each agency to develop, document, and  implement an agencywide information security program. This program  should provide security for the information and information systems that  support the operations and assets of the agency, including those provided  or managed by another agency, contractor, or other source. Among the  key activities and responsibilities associated with implementing this  program are the following:    Development, maintenance, and annual update of an inventory of major  information systems (including major national security systems) that are  operated by the agency or are under its control.
Risk-based policies and procedures that cost-effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system, including through compliance with minimally  acceptable system configuration requirements.
Security awareness training for agency personnel, including contractors  and other users of information systems that support the operations and  assets of the agency, and training for personnel with significant  responsibilities for information security.
Periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, performed with a frequency depending  on risk, but not less than annually, and that includes testing of  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information systems.
A process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency.
In addition, as part of its responsibilities for overseeing the establishment  of agency information security programs in accordance with FISMA, OMB  requires that systems be certified and accredited, a process by which  senior agency officials certify that the risk level of information systems is  acceptable and that the systems are approved for operation.
Because these key activities are interdependent, weaknesses in one  activity challenge the effective accomplishment of other FISMA activities.  For example, a complete and accurate system inventory provides a basis  for tracking FISMA compliance and for testing the effectiveness of  security controls for all systems and their components—necessary to  assess system risk. The inventory and risk assessments in turn feed an  agency’s strategy for managing risk and maintaining departmental risk- based policies and procedures. Similarly, effectively training personnel  strengthens an agency’s ability to properly and consistently implement  required security controls and to maintain an effective program over time.
To help ensure that agencies are accountable for meeting the act’s  requirements, FISMA requires each agency to annually report to OMB,  selected congressional committees, and the Comptroller General of the  United States on the adequacy of information security policies,  procedures, and practices and on compliance with requirements. Agency  heads are required to annually report the results of their independent  evaluations to OMB.
section_title: Departments Face Challenges in Implementing FISMA Requirements
paragraphs: Defense, Homeland Security, Justice, and State face challenges in  implementing key information security control activities required by  FISMA and OMB, as shown in table 1.
The reasons that the departments are challenged in these areas vary. For  example, some departments attribute weaknesses to limitations in the  tools and processes they use to perform certain activities (such as training  and remedial actions). Until the departments address these challenges and  fully implement an effective departmentwide information security  program, they increase the risk that they may not effectively protect the  confidentiality, integrity, and availability of their information and  information systems.
subsections: section_title: Identifying an Inventory of Major Information Systems Presents a Challenge for Two of the Four Departments
paragraphs: FISMA and OMB guidance require each agency to develop, maintain, and  annually update an inventory of major information systems that are  operated by the department or that are under its control. For each system,  OMB requires agencies to use their inventories to support information  resource management, including monitoring, testing, and evaluation of  information security controls.
Of the four departments, Homeland Security and Justice reported having  complete system inventories. OMB has announced in its FY 2006 Report  to Congress on Implementation of The Federal Information Security  Management Act of 2002 that Justice’s automated tool will be available to  other federal agencies under the information system security line of  business. However, Defense and State have not developed accurate and  complete FISMA inventories.
Since 2004, the IG at Defense has reported that the department does not  have a complete and accurate inventory of its major information systems.  A contributing factor to this incomplete inventory is that Defense does not  have a common definition of an information system. As noted in guidance  that the department issued in 2006, Defense policies have at least two  definitions of a system, neither of which provides consistent criteria for  what should be entered into a FISMA inventory. The 2006 guidance  provides a third set of criteria and states that the two policy definitions  should act only as a starting point. However, Defense components must  make independent interpretations of whether the asset under evaluation  should be reported as a system for FISMA purposes, and the varied  interpretations create discrepancies in the inventory. For example,  Department of the Navy officials stated that not having a common  definition of what is an information technology (IT) system makes it  virtually impossible to distinguish between a system and its constituent  subsystems/applications versus a family of systems and constituent  systems. Without establishing and enforcing the use of one common  definition, Defense cannot implement consistent inventory management  practices across its components.
State has developed a definition of a major information system for the  purposes of its inventory; however, there is disagreement with its IG  regarding how to apply the definition to individual IT assets—either  separately or as part of a consolidated system. In 2006, State’s IG found  Web applications that State officials had not included separately in their  FISMA inventory. Because of time limitations, the IG was unable to  determine whether other IT assets were missing from the inventory and  rejected the entire FISMA inventory maintained by State. State now has an  effort under way to resolve this challenge and identify all Web applications  for inclusion in the inventory. If this effort results in agreement with  State’s IG, it could help the department in obtaining independent  verification of its system inventory.
section_title: Three of the Four Departments Are Challenged in Implementing Common Security Configurations for All Systems
paragraphs: FISMA requires that agency information security programs include risk- based policies and procedures that ensure that information security is  addressed throughout the life cycle of each information system, including  through compliance with minimally acceptable system configuration  requirements. According to the NIST guidance for implementing  configuration management requirements, the policies for baseline system  configurations provide information about the makeup of a particular  system component (e.g., the standard software load for a workstation or  notebook computer, including updated patch information). In addition, the  system configuration settings are the adjustable parameters of these  components that enforce the agency security policy consistent with  operational requirements.
According to the fiscal year 2006 CIO FISMA reports, all four departments  reported that they had established a departmentwide policy for common  security configurations. However, as detailed in table 2, only State  reported successfully implementing its common configuration policy on  all system platforms. State attributes its success to the development and  implementation of a strong configuration management compliance  program known as “Evaluation and Verification.” According to State, the  program conducts remote scans to confirm whether State systems are  operating as intended, in accordance with mandatory security  configuration requirements. The program also helps provide the CIO with  an additional level of assurance by identifying known security  vulnerabilities within State systems and applications. However, Defense,  Homeland Security, and Justice reported inconsistent implementation of  common secure configuration policies across departmental systems.
Without consistent implementation of common security configurations  across systems, these departments increase the risk that their systems will  have avoidable security vulnerabilities.
section_title: Three Departments Face Challenges in Identifying Personnel Needing Training
paragraphs: FISMA mandates that all federal employees and contractors who use  department information systems be provided with periodic training in  information security awareness and accepted information security  practices. FISMA also requires agencies to provide appropriate training on  information security to personnel who have significant security  responsibilities. This training, described in NIST guidance, should inform  personnel, including contractors and other users of information systems  supporting the operations and assets of an agency, of information security  risks associated with their activities and of the roles and responsibilities of  personnel to properly and effectively implement the controls required by  policies and procedures that are designed to reduce these risks.
Although the four departments reported that they have implemented  training for the majority of their personnel, three departments face  individual challenges, as follows:    Defense officials reported that the department’s components have not  been able to document and track whether their 2.3 million users (who are  distributed worldwide) have received the required awareness training. For  example, the Department of the Army is currently unable to ensure that  users who access its IT systems have taken the required awareness  training. To overcome this obstacle, the Army has identified a need for a  componentwide tool that will ensure that only users who have taken the  required training are permitted to access its systems. In addition, Defense  officials stated that several of its components have difficulty in identifying  and tracking all employees who have significant IT security  responsibilities. For example, U.S. Air Force officials stated that it is  challenging to identify these personnel when they are not within an IT  functional area, and the Defense Information Systems Agency stated that it  is difficult to track information security training requirements for  contractors because of the lack of a central personnel database. In fiscal  year 2006, Defense issued a training and workforce improvement manual  to provide instructions to components to account for and track training of  all IT security personnel, even in the absence of a central personnel  database. Such a manual, if properly implemented, could help Defense  ensure that all personnel receive appropriate security training. However,  until Defense implements a mechanism to track training of personnel, it  will be unable to verify that personnel are effectively trained in their  information security roles and responsibilities.
Homeland Security has not been able to ensure that employees who have  significant IT security responsibilities receive specialized training.  Specifically, the Homeland Security IG reported that the department has  not yet established a program to train all individuals who have significant  IT security responsibilities. Furthermore, in fiscal year 2006, the IG  reported that Homeland Security did not ensure that employees with these  responsibilities had completed the required training in the department’s  process for validating the annual FISMA metrics. In addition, the  department reported that it was unable to accurately report on the  percentage of employees who have received specialized training because  its reporting tool counts each course taken, instead of tracking that an  individual has taken a specialized course. As a result, it could not be  assured that all users had completed required training. Homeland Security  has efforts under way to implement a centralized Web-based learning  management system that will track the completion of security training.  Until such a system is properly implemented, the department is unable to  identify personnel who have not completed required training.
State has not been able to verify that all employees and contractors have  received required annual awareness training. The State IG reported that  the department was unable to determine the total number of users who are  required to complete the annual awareness training because of duplicate  entries in State’s database that generates the number of users. Without  adequate controls to ensure the accuracy of training information, the  department cannot confirm that all personnel who require awareness  training have actually completed the training.
section_title: Departments Have Weaknesses in the Testing and Evaluation of Their Information Security Programs
paragraphs: FISMA requires that department information security programs include  periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices. This testing is to be performed with a  frequency that depends on risk, but no less than annually. It is to include  testing of management, operational, and technical controls for every  information system identified in the FISMA-required inventory of major  systems. Furthermore, a review of each system is essential to determine  the program’s effectiveness. However, as we explained in a prior report,  the depth and breadth of such system reviews are flexible and depend on  several factors, such as (1) the potential risk and magnitude of harm to the  system or data, (2) the relative comprehensiveness of the last year’s  review, and (3) the adequacy and successful implementation of the plan of  action and milestones for weaknesses in the system.
Each of the four departments reported progress in increasing the  percentage of systems for which reviews were performed and security  controls tested (see fig. 1).
However, the departments have not demonstrated adequate and effective  monitoring and evaluation of information security controls. In previous  work, we showed that guidance for performing such assessments at these  departments was not sufficient, and that the departments have not  adequately and effectively implemented policies for periodically testing  and evaluating information security controls. We reported that the  policies for the 24 Chief Financial Officer’s Act agencies for periodically  testing and evaluating security controls did not fully address elements  included in OMB and NIST guidelines and standards for performing  effective security testing and evaluations. In particular, we reported that  Defense, Homeland Security, Justice, and State had not established  adequate instructions for determining the depth and breadth of periodic  tests. Table 3 indicates weaknesses in developing and promulgating  documented policies to address the security elements needed for effective  testing.
Ensuring that departmental policies are sufficient to address federal  standards and guidelines helps to ensure their effective implementation in  meeting FISMA requirements for testing and evaluation. Until these  departments address the weaknesses in their policies, departments may  not be able to overcome the weaknesses in the corresponding security  control activities required by FISMA.
In addition, the departments reported that security control testing was not  performed consistently across all components in three of the four  departments. Justice was the only department to report that all of its  components successfully completed the required annual security control  and contingency plan testing on all their systems. This success was  achieved through the department’s efforts to establish and maintain a  system inventory and to manage departmentwide risks. In contrast,  Defense, Homeland Security, and State reported inconsistent testing of  security controls and contingency plans among their components. As  shown in tables 4 to 6, components of Defense, Homeland Security, and  State reported widely varying percentages of systems tested. For example,  at Homeland Security, the percentages for contingency plan testing ranged  from 39 to 97 percent.
Without consistent security testing across all components, a department  lacks assurance that it is maintaining adequate information security  departmentwide.
section_title: Departments Have Weaknesses in Processes for Developing Remediation Plans
paragraphs: In addition to periodically evaluating the effectiveness of security policies  and controls, acting to address any identified weaknesses is a fundamental  activity that allows an organization to manage its information security  risks cost-effectively, rather than reacting to individual problems only after  a violation has been detected or an audit finding has been reported. FISMA  directs agencies to establish a process for remediating identified  weaknesses in their information security policies and procedures. When  weaknesses are identified, agencies are required to follow OMB and NIST  guidance for developing and maintaining a plan of action and milestones.  NIST Special Publication 800-37 states that remediation plans need to be  updated to address weaknesses identified as a result of periodic testing.  Key to an effective remediation plan is the accurate and complete  inclusion of weaknesses identified during periodic testing. Remediation  plans (also referred to as plans of action and milestones) should list all  identified weaknesses and show estimated resource needs or other  challenges to resolving them, key milestones and completion dates, and  the status of corrective actions.
In their fiscal year 2006 FISMA reports, the IGs at all four departments  reported that the departments did not consistently use the remediation  plan process to manage the correction of their information security  actions. Specifically, the four departments had not fully ensured (1) that  significant IT security weaknesses are addressed in a timely manner and  receive appropriate resources or (2) that when an IT security weakness is  identified, program officials develop, implement, and manage plans of  action and milestones for their systems. Table 7 lists the challenges  identified by the four departments and IGs regarding why they struggle to  effectively handle deficiencies in information security policies,  procedures, and practices.
Although the four departments have control monitoring and weakness  remediation processes in place, each department faces barriers to  effectively incorporating these processes into their departmentwide  information security programs:    Defense officials reported that the size of the department has made it  difficult to overcome its challenges in developing remediation plans.  However, Defense is in the process of developing a departmentwide  remediation process, but the process has not been completed and  promulgated in final form. Interim guidance has been issued, and the  Defense CIO stated that more time is needed to coordinate staffing to  complete the final remediation guidance. Without complete guidance and  an established departmentwide process, Defense cannot be assured that  identified security weaknesses have been tracked and corrected.
At Homeland Security, component agencies view the departmentwide  FISMA reporting tool as more of a hindrance than a help for tracking their  weaknesses, so use of the tool is inconsistent across component agencies.  However, the department headquarters disagrees with the components on  the usefulness of the tool. Unless the department can achieve user  acceptance of this tool, it will be challenged to establish a consistent  departmentwide remediation process.
At Justice, the transition from an earlier NIST control framework to that in  the most recent guidance resulted in duplicate versions of plans of action  and milestones (one for each framework). According to Justice officials,  the department’s tool for tracking these plans does not permit easy  reconciliation of these redundancies because there is no automated  process in place to do so. As a result, the department is challenged in  accurately tracking information security weaknesses. Without such  accurate tracking, the department has little assurance that security  weaknesses are being addressed appropriately.
In September 2006, State’s IG stated that the department has not yet  verified that IT security findings and recommendations from external and  internal reviews are being addressed and resolved as part of the  remediation process. The department is aware of the need to have all data  in its tracking tool—including weaknesses reportable via the remediation  process—monitored and validated on a regular basis. To address this issue  in fiscal year 2007, the senior agency information security officer plans to  use a “system vulnerability checklist” to ensure that system owners are  aware of the weaknesses and plan to remediate them in a timely manner  according to the set milestones. If properly implemented, such a process  could help to ensure that identified security weaknesses have been  tracked and corrected.
section_title: Certification and Accreditation Processes Show Weaknesses at Three Departments
paragraphs: OMB has established a certification and accreditation process for federal  agencies that supports the establishment of the information security  programs required by FISMA. This process requires various activities,  including assessing system risk, documenting security controls in place  and planned, testing controls in place, and analyzing test results. Such a  process provides a basis on which a senior agency official decides whether  or not to approve system operation. Requiring such approvals from senior  officials helps to ensure that risk is considered in the context of  departmentwide mission operations.
However, as seen in table 8, three of the four departments reported that  not all systems in their inventory are fully certified and accredited, and  two of the four departments’ IGs rated their respective department’s  certification and accreditation process as “poor.” Only Justice overcame  its challenges of prior years and achieved success in this activity.
According to Defense officials, the reason for the low percentage reported  is that many of these systems received interim authority to operate, which  is not reflected in the reported numbers. Defense considers such interim  authorities appropriate for certain systems, such as legacy systems and  battlefield systems. However, systems without a full authorization to  operate are an increased risk to agencywide operations, contributing to  the overall risk to the agency.
In fiscal years 2005 and 2006, the Homeland Security IG reported that the  data contained in the department’s tracking tool used for monitoring the  certification and accreditation process were often either incomplete or  insufficient. In addition, in Homeland Security’s effort to produce  complete certification and accreditation documentation to satisfy federal  requirements, the department’s IG judged that the quality of work  performed and documented did not meet applicable criteria. The IG has  made recommendations to improve the quality of all certification and  accreditation documents.
In September 2006, the State IG reported that the department’s bureaus  performed certification and accreditation of their respective systems, and  that two components (Information Resource Management and Diplomatic  Security) also performed certification and accreditation on both  applications and systems. The IG believed that the certification and  accreditation process was fragmented and did not enable the department  to adequately verify that all potential vulnerabilities are being addressed.  The IG recommended that the CIO assign one entity the responsibility to  manage the certification and accreditation process. Accordingly, the  department now has an effort under way to address the inconsistencies in  its certification and accreditation process, which has received positive  feedback from internal stakeholders. Although we have not evaluated the  new process, if it is implemented consistently across the department, it  could reduce potential risks to the department’s information systems.
section_title: Conclusions
paragraphs: Defense, Homeland Security, Justice, and State face challenges in  implementing key information security control activities required by  FISMA and OMB, which include maintaining complete and accurate  system inventories, implementing common security configurations for all  system platforms, training personnel, establishing and consistently  implementing complete policies and processes for testing security  controls, and fully certifying and accrediting information systems. The  challenges in implementing these requirements arose from various  weaknesses, including inadequate tools and gaps or inconsistencies in  guidance.
These departments recognize the need to improve their implementation  processes and have begun various steps to do so. For example, State is  addressing the inconsistencies with its certification and accreditation  process, and Defense is in the process of developing a departmentwide  remediation process. Until each department improves its performance of  key FISMA activities, the likelihood of fully implementing an effective  information security program is diminished.
section_title: Recommendations for Executive Action
paragraphs: To assist the Departments of Defense, Homeland Security, Justice, and  State in addressing challenges to implementing FISMA requirements, we  are making the following 15 recommendations.
We recommend that the Secretary of Defense direct the Department of  Defense’s CIO to take the following six actions:    Develop and implement a plan with milestones to finalize and implement a  departmentwide definition of a major information system that is accepted  by the Defense IG.
Develop and implement a plan with milestones to achieve full  implementation of common security configurations across all system  platforms.
Develop and implement a plan with milestones to implement a mechanism  to track information security training of personnel (i.e., security awareness  and specialized training).
Address the weaknesses in security control testing policies as described in  this report, and ensure that components complete required annual security  control and contingency plan testing on all systems.
Complete development of the departmentwide remediation process and  finalize the remediation guidance.
Develop and implement a plan with milestones to ensure that all  information systems receive a full authorization to operate, and to improve  the department’s certification and accreditation process.
We recommend that the Secretary of Homeland Security direct the  Department of Homeland Security’s CIO to take the following four actions:    Develop and implement a plan with milestones to achieve full  implementation of common security configurations across all system  platforms.
Coordinate with Homeland Security’s Office of Human Capital to finalize  implementation of the centralized Web-based learning management  system for tracking the information security training of personnel.
Address the weaknesses in security control testing policies as described in  this report, and ensure that components complete required annual security  control and contingency plan testing on all systems.
Determine whether the department’s FISMA reporting tool meets the  requirements of different users, such as those at components, and take any  necessary corrective action.
We recommend that the Attorney General direct the Department of  Justice’s CIO to take the following three actions:   Develop and implement a plan with milestones to achieve full  implementation of common security configurations across all system  platforms.
Address the weaknesses in security control testing policies as described in  this report.
Reconcile redundancies in the department’s remediation plan tracking  tool.
Finally, we recommend that the Secretary of State direct State’s CIO to  take the following two actions:  Improve mechanisms for tracking information security awareness training  of personnel.
Address the weaknesses in security control testing policies as described in  this report, and ensure that components complete required annual security  control and contingency plan testing on all systems.
section_title: Agency Comments and Our Evaluation
paragraphs: We received written comments on a draft of this report from Defense’s  Deputy Assistant Secretary of Defense Information and Identity Assurance  (reproduced in app. II), from the Director of Homeland Security’s  Departmental GAO/OIG Liaison Office (reproduced in app. III), from  Justice’s Assistant Attorney General for Administration (reproduced in  app. IV), and from State’s Assistant Secretary for Resource Management  and Chief Financial Officer (reproduced in app. V). In these comments,  officials from Homeland Security, Justice, and State generally agreed with  our recommendations to their respective departments, and stated that they  had implemented or were in the process of implementing them. Defense  generally agreed with two recommendations, partially agreed with a third,  and did not agree with the other three. All four departments provided  technical comments, which we have incorporated as appropriate.
In its comments, Defense did not concur with our recommendation to  develop and implement a departmentwide definition of a major  information system that is accepted by the Defense IG. Defense stated that  it has a standard definition for FISMA reporting and has informed the  Defense IG that it will continue to use the definition in the annual data  call. While Defense does have a definition of a major information system  specified in its annual IT repository guidance, as we discuss in our report,  Defense’s own guidance provides at least two definitions of a system. This  forces the components, and the Defense IG, to make independent  interpretations of what should be included in the inventory for FISMA  reporting purposes, leading to inconsistent results. Thus, we continue to  believe our recommendation has merit.
Defense partially concurred with our recommendation to achieve full  implementation of common security configurations across all system  platforms, noting that it was spearheading a federal initiative and that the  policy is planned for implementation by February 2008. Defense concurred  in principle with our recommendation to implement a mechanism to track  information security training of personnel and stated that the department  has already initiated actions to complete the recommendation. Defense  also concurred in principle with our recommendation to address the  weaknesses in security control testing policies and ensure that  components complete required security control and contingency plan  testing for all systems.
Defense did not concur with our recommendation to complete the  development of the departmentwide remediation process and finalize the  remediation guidance. However, officials commented that the interim  guidance, discussed in our report, will be finalized in September 2007.  Defense also did not concur with our recommendation to ensure that all  information systems receive a full authorization to operate and to improve  the department’s certification and accreditation process. Defense stated  that it believes an interim authorization to operate represents a sound risk  management practice and balances operational requirements with  acceptable risk, while further noting that its combined interim and full  authorizations to operate total 91.9 percent of Defense systems. Although  interim authorizations to operate represent some level of accepting risk,  we believe that without a full authorization to operate, there is an  increased risk to the department’s operations and continue to believe our  recommendation has merit.
In addition, Defense stated that the report does not accurately reflect the  current security posture of the department and the progress it has made in  implementing the provisions of FISMA. Throughout our report, where  appropriate, we acknowledge the progress made by the department in  implementing the provisions of FISMA and have deleted certain outdated  information contained in the draft report. Nonetheless, Defense still faces  challenges in individual areas of FISMA as noted in our report.
In its comments, Homeland Security noted that the report does not  provide common solutions that could be applied to large agencies across  the federal government. Our review was not governmentwide in scope;  rather, it was limited to challenges faced by Defense, Homeland Security,  Justice, and State. Accordingly, our recommendations are addressed  individually to these four departments.
State also provided several comments related to the contents of our  report. First, the department did not agree with the report’s implication  that the issues associated with the recommendations serve as challenges  or obstacles that inhibit the implementation of FISMA. Rather, State  characterizes them as weaknesses that are receiving the proper attention.  We believe that the issues identified in our report are appropriately  characterized as the challenges State faces with regard to verifying  whether all of its employees received the required FISMA security  awareness training and with regard to certifying and accrediting its  systems. Our report also discusses the progress State has made in these  two areas.
Second, in response to the recommendation to improve mechanisms for  tracking information security awareness training of all personnel, State  asserted that the report declared that it is unable to identify all of its  employees. However, our report does not make this claim; instead, we  note that State has not been able to verify that all of its employees and  contractors have received the required training.
Finally, State also noted in its comments that prior GAO reports and  testimonies discussed the lack of a common IG reporting framework and  that current FISMA reporting does not take full account of an agency’s  ability to detect, respond to, and react to cyber security threats and  manage vulnerabilities. While State officials told us that these issues  inhibit the department from implementing the provisions of FISMA, we  emphasize that despite external factors, which may influence  measurement or perception of an agency’s performance, the department  still controlled the internal processes that effectively execute all of the  information security program activities required by FISMA, which  constituted the scope of this report. These issues were addressed, as noted  by State in its comments, on a governmentwide basis in other GAO reports  and testimonies that had a broader scope.
As we agreed with your office, unless you publicly announce the contents  of this report earlier, we plan no further distribution of it until 30 days  from the date of this letter. At that time, we will send copies of this report  to interested congressional committees; the Secretaries of Defense,  Homeland Security, and State; and the U.S. Attorney General. We will also  make copies available to others on request. In addition, this report will be  available at no charge on the GAO Web site at http://www.gao.gov.
If you have any questions regarding this report, please contact me at   (202) 512-6244 or by e-mail at wilshuseng@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on the  last page of this report. Key contributors to this report are listed in  appendix VI.
section_title: Appendix I: Objective, Scope, and Methodology
paragraphs: Our objective was to determine the challenges or obstacles that inhibit the  implementation of the information security provisions of the Federal  Information Security Management Act of 2002 (FISMA) at the  Departments of Defense, Homeland Security, Justice, and State.
To do this, we reviewed and analyzed FISMA (Public Law 107-347) and  mapped these requirements to (1) National Institute of Standards and  Technology (NIST) guidelines and (2) Office of Management and Budget  (OMB) reporting requirements. We also reviewed and analyzed relevant  NIST special publications and federal information processing standards  that were created and modified due to FISMA, as well as guidance and  reports issued by OMB. For example, we reviewed and analyzed its Fiscal  Year 2005 Report to Congress on Implementation of The Federal  Information Security Management Act of 2002 and OMB Circular A-130,  Management of Federal Information Resources. In addition, we reviewed  our previous information security work. We also interviewed individuals  from OMB’s Office of Information and Regulatory Affairs and Office of  General Counsel and interviewed officials from the NIST Computer  Security Division to discuss their FISMA implementation project work as  mandated by FISMA.
We also reviewed and analyzed chief information officer (CIO) and  inspectors general FISMA reports for fiscal years 2003 through 2006 at  Defense, Homeland Security, Justice, and State. In addition, we reviewed  and analyzed various plans, policies, and procedures at the four  departments. These included strategic plans, risk management policies,  and budget documentation. We also held structured interviews with  individuals who had FISMA implementation as their primary responsibility  at each department and at selected department components. Specifically,  at Defense we interviewed individuals from the Office of the Secretary of  Defense as well as three Defense service components—the Departments  of the Army and Navy, and the U.S. Air Force—and individuals from the  Defense Information Systems Agency. At Homeland Security, we  interviewed officials within the Office of the CIO as well as from the U.S.  Coast Guard, Federal Emergency Management Agency, U.S. Citizenship  and Immigration Services, Transportation Security Administration, and  U.S. Immigration and Customs Enforcement. At Justice, we interviewed  officials within the Bureau of Alcohol, Tobacco, Firearms and Explosives;  the Justice Management Division; the Federal Bureau of Investigation; the  Executive Office of United States Attorneys; and the Drug Enforcement  Administration. At State, we interviewed officials of the Office of the Chief  Information Officer, the Office of Foreign Missions, the Bureau of  Diplomatic Security, and the Bureau of Information Resources  Management. Finally, we met with the Office of the Inspector General at  each of the four departments to discuss what challenges its department  has encountered in implementing FISMA.
Our work was conducted in Washington, D.C., from July 2006 through May  2007. All work was performed in accordance with generally accepted  government auditing standards.
section_title: Appendix II: Comments from the Department of Defense
section_title: Appendix III: Comments from the Department of Homeland Security
section_title: Appendix IV: Comments from the Department of Justice
section_title: Appendix V: Comments from the Department of State
section_title: Appendix VI: GAO Contact and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, key contributions to this report  were made by Barbara Collier, Nancy DeFrancesco (Assistant Director),  Neil Doherty, Timothy Eagle, Jennifer Franks, Nancy Glover, Anjalique  Lawrence, Stephanie Lee, David Plocher, and Jonathan Ticehurst.