Federal Information Security: Agencies and OMB Need to Strengthen Policies and Practices
Released: 2019-07-26T00:00:00

Letter

Background

IT systems supporting federal agencies are inherently at risk. These systems are highly complex and dynamic, technologically diverse, and often geographically dispersed. This complexity increases the difficulty in identifying, managing, and protecting the numerous operating systems, applications, and devices comprising federal systems and networks. Compounding these risks, federal systems and networks are often interconnected with other internal and external systems and networks, including the internet, thereby increasing the number of avenues of attack and expanding their potential attack surface.

Without proper safeguards, computer systems are vulnerable to individuals and groups with malicious intent who can intrude and use their access to obtain sensitive information, commit fraud and identity theft, disrupt operations, or launch attacks against other computer systems and networks. Cyber-based threats to information systems can come from sources internal and external to the organization. Internal threats include errors or mistakes, as well as fraudulent or malevolent acts by employees or contractors working within the organization. External threats include the ever-growing number of cyber-based attacks that can come from a variety of sources such as individuals, groups, and countries that wish to do harm to an organization’s systems.

Yet, IT systems are often riddled with security vulnerabilities—both known and unknown. These vulnerabilities can facilitate security incidents and cyberattacks that disrupt critical operations; lead to inappropriate access to and disclosure, modification, or destruction of sensitive information; and threaten national security, economic well-being, and public health and safety.

Federal Agencies Continue to Report Large Numbers of Incidents

Until fiscal year 2016, the number of information security incidents reported by federal agencies to DHS’s United States Computer Emergency Readiness Team (US-CERT) had steadily increased each year. From fiscal year 2009 through fiscal year 2015, reported incidents increased from 29,999 to 77,183, an increase of 157 percent. Changes to federal incident reporting guidelines for 2016 contributed to the decrease in reported incidents in fiscal year 2016. Specifically, updated incident reporting guidelines that became effective in fiscal year 2016 no longer required agencies to report non-cyber incidents or incidents categorized as scans, probes, and attempted access.

More recently, agencies reported 35,277 incidents in fiscal year 2017 and 31,107 incidents in fiscal year 2018, as reflected in figure 1.

According to US-CERT incident report data, the incidents reported in fiscal year 2018 involved several threat vectors. These threat vectors include web-based attacks, phishing attacks, and the loss or theft of computer equipment, among others. Figure 2 provides a breakdown of information security incidents by threat vector in fiscal year 2018.

These incidents and others like them can pose a serious challenge to national security, economic well-being, and public health and safety, as shown by two incidents reported in fiscal year 2018: In March 2018, the Department of Justice reported that it had indicted nine Iranians for conducting a massive cybersecurity theft campaign on behalf of the Islamic Revolutionary Guard Corps. According to the department, the Iranians allegedly stole more than 31 terabytes of documents and data from more than 140 American universities, 30 U.S. companies, and five federal government agencies, among other entities.

In March 2018, a joint alert from DHS and the Federal Bureau of Investigation stated that, since at least March 2016, Russian government actors had targeted U.S. government entities and critical infrastructure sectors, including the energy, nuclear, water, aviation, and critical manufacturing sectors.

FISMA Sets Requirements for Effectively Securing Federal Systems and Information

Congress enacted FISMA 2014 to provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets and to clarify government-wide responsibilities. The act addresses the increasing sophistication of cybersecurity attacks, promotes the use of automated security tools with the ability to continuously monitor and diagnose the security posture of federal agencies, and provides for improved oversight of federal agencies’ information security programs.

FISMA requires agencies to develop, document, and implement an agency-wide information security program to secure federal information systems. These information security programs are to provide risk-based protections for the information and information systems that support the operations and assets of the agency. FISMA requires agencies to comply with OMB policies and procedures, DHS binding operational directives, and NIST federal information standards and guidelines. In addition, FISMA assigns to agency inspectors general responsibility for annually assessing the effectiveness of the information security policies, procedures, and practices of the agency.

FISMA directs OMB to oversee agencies’ information security policies and practices. Among other things, FISMA requires OMB to develop and oversee the implementation of policies, principles, standards, and guidelines on information security in federal agencies, except with regard to national security systems. The law also assigns OMB the responsibility of requiring agencies to identify and provide information security protections commensurate with assessments of risk to their information and information systems.

In addition, FISMA 2014 clarified and expanded DHS’s responsibilities for government-wide information security. Specifically, the act requires DHS, in consultation with OMB, to administer the implementation of agency information security policies and practices for non-national security information systems by: (1) assisting OMB with carrying out its oversight responsibilities; (2) developing, issuing, and overseeing implementation of binding operational directives; and (3) providing operational and technical assistance.

Further, FISMA 2002 assigned to NIST the responsibility for developing standards and guidelines that include minimum information security requirements.

FISMA also includes reporting requirements. Specifically, OMB is to report annually, in consultation with DHS, on the effectiveness of agency information security policies and practices, including a summary of major agency information security incidents and an assessment of agency compliance with NIST standards. Further, the law requires agencies to report annually to OMB, DHS, certain congressional committees, and the Comptroller General on the adequacy and effectiveness of their information security policies, procedures, and practices, including a description of each major security incident.

Federal Agencies Are Required to Use the Cybersecurity Framework to Manage Risk and to Report on FISMA Implementation

In May 2017, the President signed Executive Order 13800, which sets policy for managing cybersecurity risk as an executive branch enterprise. Specifically, the order outlines actions to be taken by federal agencies and critical infrastructure sectors to improve the nation’s cybersecurity posture and capabilities. To this end, the order states that the President will hold executive agency heads accountable for managing agency-wide cybersecurity risk and directs each executive branch agency to use the NIST cybersecurity framework to manage those risks. In addition to requirements set in the executive order, OMB’s reporting metrics that were developed to facilitate agencies’ compliance with FISMA’s reporting requirement are aligned to the core functions outlined in the cybersecurity framework. Consequently, agencies are required to report on the effectiveness of their information security policies and practices according to the cybersecurity framework’s core functions.

NIST Framework’s Five Core Functions Are Aimed at Managing Cybersecurity Risk

The NIST cybersecurity framework is based on five core security functions: Identify: Develop an understanding of the organization’s ability to manage cybersecurity risk to systems, people, assets, data, and capabilities.

Protect: Develop and implement appropriate safeguards to ensure delivery of critical services.

Detect: Develop and implement appropriate activities to identify the occurrence of a cybersecurity event.

Respond: Develop and implement appropriate activities to take action regarding a detected cybersecurity incident.

Recover: Develop and implement appropriate activities to maintain plans for resilience and to restore capabilities or services that were impaired due to a cybersecurity incident.

According to NIST, these five functions should be performed concurrently and continuously to address cybersecurity risk. In addition, when considered together, they provide a high-level, strategic view of the life cycle of an organization’s management of cybersecurity risk. Within the five functions, NIST identifies 23 categories and 108 subcategories of activities and controls for achieving the intent of each function. Appendix II provides a description of the cybersecurity framework categories and subcategories of activities and controls.

Inspectors General Are to Measure the Effectiveness of Agencies’ Information Security Programs Using the Cybersecurity Framework Core Functions

The Council of Inspectors General for Integrity and Efficiency (CIGIE), in collaboration with OMB, DHS, and other stakeholders, developed a capability maturity model for agency inspectors general to assess and report on the effectiveness of their agencies’ information security programs. As described in table 1, the model identifies five maturity levels with each succeeding level representing a more advanced level of implementation.

Using the five-level maturity model described above, the inspectors general are to assign a maturity-level rating for each of the five core security functions based on an assessment of their agencies’ implementation of the activities and controls associated with each function using metrics that CIGIE developed in collaboration with OMB. The inspectors general then consider the maturity level ratings of the core security functions to evaluate the overall effectiveness of their agency’s information security program.

OMB instructs inspectors general to rate their agency’s information security program as effective or not effective by applying a rule of simple majority. Specifically, if three or more of the five core security functions are rated effective, the overall information security program is considered to be effective. According to this maturity model, Level 4 (managed and measurable) is the lowest level to represent an effective level of security. Therefore, if an inspector general rates three or more of the agency’s core security functions at Level 4 or Level 5, then the inspector general can consider that agency to have an effective information security program. However, the inspector general has the discretion to have a different conclusion on program effectiveness if he or she deems it appropriate to do so.

CIOs Are Required to Assess Agencies’ Progress in Implementing Capabilities Related to the Administration’s Cybersecurity-related Cross- Agency Priority Goal

Similar to the inspector general FISMA reporting metrics, OMB and DHS worked with interagency partners to develop the CIO FISMA metrics, which are intended to be used by the agencies, OMB, and DHS to track agencies’ progress in implementing cybersecurity capabilities. The CIO FISMA reporting metrics are organized around the five core security functions outlined in NIST’s cybersecurity framework.

In addition, certain CIO FISMA reporting metrics represent key milestones of the administration’s IT Modernization Cross-Agency Priority (CAP) goal, which includes a cybersecurity initiative. As a result, the CIO reporting metrics allow agency CIOs, OMB and DHS to monitor progress toward meeting key milestones and targets for the CAP goal.

The cybersecurity initiative within the IT Modernization CAP goal is designed to reduce cybersecurity risks to the federal government’s information systems by mitigating the impact of risks to federal data, systems, and networks. The initiative consists of three strategies that contain 10 milestones that relate to key areas within the CIO FISMA metrics—information security continuous monitoring; identity, credential, and access management; and advanced network and data protections. In addition, each of the 10 milestones has an expected level of performance, or target, for implementation, as described later in this report.

Reported Information Security Spending Varies Among the 23 Civilian CFO Act Agencies

Each year, OMB requires agencies to report how much they spend on information security. In fiscal year 2018, the 23 civilian agencies covered by the CFO Act reported spending between $9 million and almost $1.9 billion on cybersecurity- or IT security-related activities. For these 23 agencies, their total reported security spending accounted for about 14 percent of their IT spending, with percentages for individual agencies ranging from 5 percent to 208 percent, as seen in table 2.

Security Control Deficiencies Reported at Selected Agencies Indicate Ineffective Information Security Policies and Practices

Information security reports issued by GAO, inspectors general, and CIOs indicate that information security policies and practices of the agencies we reviewed are ineffective. Specifically, information security evaluation reports that we and agency inspectors general issued during fiscal year 2018 showed that most of the 16 selected agencies did not consistently or effectively implement policies or practices related to the core security functions of the cybersecurity framework. In addition, most of these selected agencies had deficiencies in implementing the eight elements of an information security program, as defined by FISMA. Also, inspectors general reported that most of the 24 CFO Act agencies did not have effective information security programs and were not effectively implementing security controls over financial systems during fiscal year 2018. Further, agency CIOs reported that most of the 23 civilian CFO Act agencies had not met targets for implementing cyber capabilities to reduce risk.

Most of the 16 Selected Agencies Exhibited Deficiencies in All Cybersecurity Framework Core Security Functions

FISMA requires agencies and their inspectors general to report on the adequacy and effectiveness of information security policies, procedures, and practices. To facilitate meeting this reporting requirement, CIGIE, in collaboration with OMB and DHS, developed metrics that agency inspectors general are to use to report on eight security domains that align with the five core security functions—Identify, Protect, Detect, Respond, and Recover—of the NIST cybersecurity framework. Table 3 illustrates how the inspector general reporting domains are related to the core security functions.

Most of the 16 agencies that we reviewed had deficiencies in implementing policies and practices related to the cybersecurity framework core security functions and related domains during fiscal year 2018. Figure 3 shows the number of agencies with reported deficiencies in each of the framework’s core security functions.

The Identify core security function includes the key process of risk management. NIST defines risk management as the process of identifying and assessing risk, and taking steps to reduce those risks to an acceptable level. NIST guidance specifies activities that agencies should implement to effectively identify and manage cybersecurity risks, including: establishing a risk management strategy that includes a determination identifying assets that require protection; assessing risk; and documenting plans of action and milestones (POA&Ms) to mitigate known deficiencies.

Fifteen of the 16 selected agencies had deficiencies in activities associated with identifying risks. Figure 4 illustrates the number of selected agencies that had deficiencies in each of the activities.

Establishment of a Risk Management Strategy Risk management strategies include strategic-level decisions and considerations for how senior leaders and executives are to manage risk to organizational operations and assets, individuals, other organizations, and the nation. GAO and inspectors general reports identified that 10 of the 16 selected agencies had deficiencies in developing, documenting, or implementing a risk management strategy. Specifically, nine of the 10 agencies had not developed or documented an enterprise-wide risk management strategy or process. Another agency had developed an enterprise risk management strategy but had not implemented it consistently across the agency.

Without developing or documenting a risk management strategy, agencies lack clear guidance to help them make informed decisions for managing risk. Further, if agencies do not consistently implement a risk management strategy, they can potentially hinder their efforts to effectively identify and manage risk.

FISMA requires agencies to develop and maintain an inventory of major information systems operated by or under the control of the agency to support risk management activities. Further, NIST Special Publication 800-53 states that centralized inventories of hardware, software, and firmware assets should be maintained to ensure proper accountability of those assets. These inventories also should be current, complete, and accurate to ensure proper accountability.

Twelve of the 16 selected agencies did not fully identify or account for their major information systems or information technology assets. One agency did not maintain a comprehensive and accurate inventory of information systems and two other agencies did not maintain a current inventory of hardware and software assets. Nine additional agencies maintained neither a comprehensive and accurate inventory of information systems nor a current inventory of software and hardware assets. If agencies do not maintain comprehensive, accurate, or up-to- date inventories of information systems or hardware and software assets, agencies cannot ensure the protection of all assets within their networks.

FISMA requires agencies to develop, document, and implement an agency-wide information security program that includes periodic risk assessments. According to NIST, these assessments are to address potential adverse impacts resulting from the operation and use of information systems and the information those systems process, store and transmit.

Eight of the 16 selected agencies exhibited deficiencies in conducting risk assessments. Of the eight agencies that had deficiencies, four did not consistently perform risk assessments of their information systems; three did not fully update risk assessments subsequent to system changes; and one did not conduct a risk assessment supporting the agency’s decision to allocate resources to support mission and business processes. Without a sufficient process for conducting periodic risk assessments, agencies cannot determine, or appropriately respond to, risks to the information systems supporting the organization.

Documentation of Plans of Action and Milestones FISMA requires agency information security programs to include a process for planning, implementing, evaluating, and documenting remedial action to address deficiencies in information system policies, procedures, and practices. In addition, NIST’s risk management framework states that agencies should implement a consistent process for developing POA&Ms using a prioritized approach to risk mitigation that is guided by a risk assessment. Further, documentation of POA&Ms should also be updated to reflect the current status of the deficiencies and, after remedial actions have been completed, agencies should test the actions to determine if they effectively addressed the deficiencies.

Thirteen of the 16 selected agencies had deficiencies in their POA&M processes. Specifically, five agencies did not have an effective process for remediating vulnerabilities in a timely manner; seven other agencies did not adequately document or track the status of POA&Ms; and another agency did not assess the root cause of identified deficiencies to prioritize corrective actions based on the highest areas of risks. Additionally, one of the agencies that did not adequately document POA&Ms also did not have sufficient evidence to conclude that deficiencies were corrected even though the agency validated the remediation of the deficiency through its closure verification process.

Without sufficiently documenting POA&Ms, agencies may not sufficiently remediate information security deficiencies in a timely manner, exposing their systems to increased risks that nefarious actors will exploit the deficiencies to gain unauthorized access to information resources.

All Selected Agencies Had Deficiencies in Developing and Implementing Appropriate Safeguards to Protect Cyber Assets

Agencies are to implement appropriate safeguards associated with the following four security domains that align with the Protect core security function: identity and access management; data protection and privacy; and security training.

Each of the 16 selected agencies was deficient in developing and implementing appropriate safeguards to protect agency systems and networks. As shown in figure 5, most of the selected agencies had deficiencies in each of the four domains.

NIST guidelines specify that agencies are to develop, implement, and maintain a baseline configuration; control changes to system configurations; and securely configure information systems. However, 14 of the selected 16 agencies reported weaknesses in one or more of these configuration management activities.

Of the 14 agencies, nine had weaknesses in developing, maintaining, and implementing a baseline configuration for their information systems. For example, four agencies did not develop a baseline configuration for all systems or network devices. In addition, two agencies did not review or approve their baseline configurations. Further, three agencies did not consistently implement their baseline configurations. If agencies do not develop, maintain, or implement a current and comprehensive baseline of information systems and network devices, agencies cannot validate configuration information for accuracy, thereby hindering them from controlling changes made to a system.

Eleven agencies did not effectively or consistently control changes to the configuration of their information systems. Properly controlling system changes can help agencies to ensure that changes are formally identified, proposed, reviewed, analyzed for security impact, tested, and approved prior to implementation. However, six of the 11 agencies did not properly approve or test changes before they were implemented; four other agencies did not consistently implement change control activities across their organization or their information systems; and one other agency did not consistently ensure accountability and responsibility for individuals performing configuration management activities.

In addition, 12 agencies did not securely configure their information systems. NIST specifies that agencies should apply software patches in a timely manner, use vendor-supported software, apply secure configuration settings, and limit system functionality to least level needed to meet organizational requirements. However, of the 12 agencies that had deficiencies in implementing secure configurations, nine did not implement patches to address vulnerabilities or use up-to-date software that was supported by a vendor. Ten agencies also did not apply secure configuration settings to effectively enable security and facilitate the management of risk, while two agencies did not implement controls for limiting system functionality. As a result, these agencies cannot validate configuration information for their information systems and assets, detect or prevent unauthorized changes to information system resources, or provide a reasonable assurance that systems are configured and operating securely and as intended.

Access controls are intended to limit or detect inappropriate access to computer resources to protect them from unauthorized modification, loss, and disclosure. Such controls include logical controls that require users to validate their identity and limit the files and other resources that those validated users can access and the actions they can execute.

All 16 agencies that we reviewed had deficiencies in effectively implementing one or more controls associated with the identity and access management domain during fiscal year 2018. Fifteen of the 16 selected agencies did not adequately control user’s access to information systems and the information residing on them. For example, seven agencies did not appropriately authorize or approve system access before access was granted, and eight agencies did not perform user access reviews to ensure that they complied with account management policy.

Additionally, 11 of the 16 agencies did not properly identify and validate information system users, which involve enforcing strong passwords and requiring passwords to be changed periodically. In addition, 11 of the 16 agencies had deficiencies in implementing access management to ensure separation of duties, or segregating work responsibilities so that one individual does not control all critical stages of a process. Without adequate access controls, unauthorized individuals, including outside intruders and former employees, can surreptitiously read and copy sensitive data and make undetected changes or deletions for malicious purposes or personal gain.

According to NIST guidance on security and privacy controls, agencies should protect data at rest and in transit on their network through implementation of cryptography and other technologies to achieve confidentiality and integrity protections over that data. In addition, NIST’s guidance states that agencies should implement contingency strategies, such as conducting backups of information systems and having alternate processing and storage sites to protect data from loss during an interruption and to resume activities after an interruption. Further, NIST guidance states that agencies should develop privacy policies, procedures, and guidance for safeguarding the collection, access, use, dissemination, and storage of personally identifiable information that supports a privacy program.

However, 15 of the 16 selected agencies did not effectively implement controls to protect data and ensure its privacy during fiscal year 2018. Specifically, eight of the 16 agencies did not adequately implement controls for protecting information at rest and four agencies did not adequately implement controls for ensuring the integrity and confidentiality of data in transit. In addition, five of the 16 agencies did not conduct backups of information systems and five agencies did not use alternate processing sites to retrieve backups or resume essential mission/business functions. Further, the inspectors general for 14 of the 16 agencies reported that their respective agency did not effectively document or implement policies and procedures supporting the agency’s privacy program. If agencies do not effectively implement controls to protect data and ensure its privacy, agencies may be hindered in limiting or containing the impact of a potential cybersecurity event.

FISMA requires agency information security programs to include security awareness training to inform personnel of information security risks associated with their activities and responsibilities in complying with agency policies and procedures intended to reduce risk. In addition, FISMA requires agencies to provide role-based training to personnel with significant responsibilities for information security. Further, NIST guidance on building an IT security awareness and training program states that an awareness and training program is the means to communicate information that users need to support the mission of the organization, and security requirements across the agency.

Most of the selected agencies exhibited deficiencies in implementing a security training program during fiscal year 2018. Only three of the 16 selected agencies effectively implemented elements of a security training program. Of the 13 agencies that had deficiencies, 12 did not ensure that personnel received security awareness training and 10 did not ensure that personnel with significant responsibilities for information security received role-based training, including nine agencies that were deficient in providing both types of training. As a result, these agencies risk having employees or contractors that are ill-prepared to protect systems, and risk inadvertently or intentionally compromising security.

Most of the Selected Agencies Had Not Effectively Developed or Implemented Controls to Detect Cyber Events and Vulnerabilities

Agencies are to develop and implement controls to Detect cyber events and vulnerabilities. FISMA requires agencies to develop, document, and implement an agency-wide information security program that includes periodic testing and evaluation of effectiveness and procedures for detecting security incidents. NIST guidelines define these and other activities as part of information security continuous monitoring, including: defining an information security continuous monitoring strategy and implementing an information security continuous monitoring program in accordance with that strategy; assessing and reporting on the effectiveness of all implemented collecting, correlating, and analyzing security related information obtained through information system auditing.

However, as shown in figure 6, agencies exhibited deficiencies in activities associated with information security continuous monitoring.

Continuous Monitoring Strategy and Program NIST’s guidance on information security continuous monitoring states that defining an information security continuous monitoring strategy and developing an information security continuous monitoring program are the first two steps in creating, implementing, and maintaining information security continuous monitoring. In addition, agencies should implement the information security continuous monitoring program in accordance with the defined strategy.

However, half of the 16 selected agencies did not develop an information security continuous monitoring strategy or program, or implement the information security continuous monitoring program. Specifically, five of the agencies did not fully develop an information security continuous monitoring strategy or program. In addition, while three agencies had developed, or made organizational changes to create a foundation for, an information security continuous monitoring strategy, those agencies did not consistently or effectively implement the strategy. Without a well- designed and implemented information security continuous monitoring strategy, agencies could be hindered in assuring ongoing situational awareness of information security, vulnerabilities, and threats.

As stated above, FISMA requires agencies to include periodic testing and evaluation of information security policies, procedures, and practices in agency-wide information security programs. Security control assessments determine the extent to which controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the system requirements.

Most agencies assessed the controls implemented on their systems. However, seven agencies did not consistently perform system control assessments to ensure that the controls were operating effectively, or as intended. Further, seven agencies had not completed or implemented other activities in their security assessment and authorization process that assists agencies with ensuring that appropriate controls are implemented on an information system and that the system is authorized to operate. If agencies do not perform consistent testing of information security controls, they cannot determine that implemented controls are appropriately designed or operating effectively.

Audit Review, Analysis, and Reporting According to NIST guidance on log management, routine log analysis is beneficial to identifying security incidents, policy violations, fraudulent activity, and operational problems. As a result, log analysis supports information security continuous monitoring capabilities.

However, more than half of the 16 selected agencies did not review, analyze, and report auditable events from audit logs. For example, nine agencies did not implement audit log review capabilities on their information systems. Without reviewing, analyzing, and reporting audit logs, agencies limit their ability to identify unauthorized, unusual, or sensitive access activity on their networks.

Most of the Selected Agencies Exhibited Deficiencies in Developing and Implementing Controls to Respond to Detected Cyber Intrusions

Agencies should have policies and practices in place to Respond to detected incidents. FISMA requires agency information security programs to include procedures for responding to security incidents in order to mitigate risks associated with such incidents before substantial damage is done. According to NIST, incident response involves rapidly detecting incidents, minimizing loss and destruction, mitigating the weaknesses that were exploited, and restoring IT services. An effective incident response process includes, for example: an incident handling capability that incorporates lessons learned from ongoing incident handling activities; the monitoring of incidents through documentation that includes pertinent information necessary for forensics, evaluating incident details, trends, and handling; the timely reporting of incidents with sufficient detail to allow analysis; and an incident response plan.

Most of the 16 selected agencies had deficiencies in at least one of the activities associated with incident response processes, as shown in figure 7.

According to NIST, agencies should have the ability to detect and analyze security incidents in order to minimize loss and destruction and mitigate the weaknesses that were exploited. In addition, agencies should incorporate lessons learned from an incident to improve existing security controls and practices.

Most of the selected agencies did not report deficiencies associated with their incident handling capability, including the ability to analyze and respond to security incidents and incorporate lessons learned. However, seven agencies did not adequately implement capabilities to analyze and respond to security incidents. In addition, one of the seven agencies did not use lessons learned from prior incidents to improve incident handling. Without an effective incident handling capability, agencies have limited ability to detect and analyze security incidents to minimize destruction and mitigate exploited vulnerabilities.

According to NIST, agencies should monitor and document security incidents with sufficient detail in order to effectively respond to and mitigate the risks associated with the incident. Doing so enables agencies to analyze security incidents, understand the impact of the incident, and perform analysis to identify trends and indicators of attack.

Inspectors general for 12 of the 16 selected agencies did not identify deficiencies related to monitoring detected incidents. However, four agencies did not effectively monitor incidents. For example, one agency did not consistently document incidents detected and another agency had not implemented an automated enterprise tool for monitoring incidents. If agencies do not effectively implement incident monitoring processes, they hinder their ability to adequately analyze and respond to security incidents.

FISMA requires agencies to develop, document, and implement an agency-wide information security program that includes procedures for reporting security incidents to US-CERT. In addition, NIST guidance states that agencies should have specific incident reporting requirements for reporting suspected security incidents to an internal incident reporting organization.

However, 10 agencies had deficiencies in their implementation of incident reporting. While only two agencies did not clearly define incident reporting requirements, eight agencies did not effectively implement those requirements. For example, these agencies did not consistently categorize incidents or ensure timely reporting of incidents to US-CERT and internal reporting organizations. If agencies do not consistently categorize or report incidents in an accurate and timely manner, they cannot effectively respond to incidents because they may lack effective situational awareness in order to appropriately respond to incidents.

Incident response plans are an important element to ensuring that incident response is performed effectively, efficiently, and consistently throughout the agency. Among other things, NIST guidance states that incident response plans should provide a roadmap for implementing an incident response capability, describe metrics for measuring the incident response capability, and be approved.

Inspectors general for nine of the selected agencies did not report deficiencies related to incident response plans. However, seven agencies did not fully develop or monitor the effectiveness of their incident response plans. Specifically, five agencies had incident response plans that did not fully define requirements for implementing their incident response capability or were not approved. In addition, the other two agencies did not use performance metrics to verify the effectiveness of their incident response plan. Without an effective and comprehensive incident response plan, agencies cannot implement a coordinated approach to incident response.

More Than Half of the Selected Agencies Had Not Adequately Developed or Implemented Practices to Recover from Cyber Events

Agencies should be able to Recover from cyber events. FISMA requires agencies to develop, document, and implement an agency-wide information security program that includes plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. NIST defines contingency planning as a coordinated strategy involving plans, procedures, and technical measures that enable the recovery of information systems, operations, and data after a disruption. Contingency planning is significant to protecting electronically maintained data and an agency’s ability to process and retrieve data during and after a cyber intrusion. According to NIST, agencies should develop and document a comprehensive contingency plan or suite of related plans for restoring capabilities during and after a cyber event. The suite of related plans should include a disaster recovery plan and business impact analysis.

However, 11 of the 16 selected agencies did not sufficiently plan for recovering system operations after an interruption. Specifically, these 11 agencies did not consistently develop contingency plans, to include disaster recovery plans, or other associated documentation, such as business impact analyses for all of their information systems. In addition, one agency did not define how the agency is to process and retrieve data during and after an interruption. Without an effective contingency planning process, agencies are exposed to the risk of interruptions to information system operations and disruption to their mission and business processes.

Most of the 16 Selected Agencies Exhibited Deficiencies in Implementing Elements of an Information Security Program

Controls associated with the five core security functions are related to elements of agencies’ information security programs. FISMA requires each agency to develop, document, and implement an information security program that includes the following eight elements: 1. periodic assessments of the risk; 2. cost-effective policies and procedures that reduce risk to an acceptable level, ensure that information security is addressed throughout the life cycle of each system, and ensure compliance with applicable requirements; 3. subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems, as appropriate; 4. security awareness training and training for personnel with significant responsibilities for information security; 5. periodic testing and evaluation of the effectiveness of security policies, procedures, and practices; 6. a process for planning, implementing, evaluating, and documenting remedial actions to address information security deficiencies; 7. procedures for detecting, reporting, and responding to security 8. plans and procedures to ensure continuity of operations for information systems.

As discussed earlier in this report, most of the 16 selected agencies had deficiencies related to implementing the eight elements of an agency- wide information security program. Figure 8 shows the number of selected agencies with deficiencies in implementing the eight elements of an agency-wide information security program.

For example, of the 16 selected agencies:

Eight agencies did not effectively assess risk;

11 agencies did not have policies to ensure that CIOs carried out their role as it relates to information security;

Four agencies developed incomplete system security plans;

13 agencies did not ensure that personnel received security awareness training, or that personnel with security responsibilities received role-based security training;

Seven agencies did not consistently perform control assessments to ensure that the controls were operating effectively, or as intended;

13 agencies did not effectively implement their POA&M process to address information security deficiencies;

13 agencies did not adequately detect or respond to incidents; and

11 agencies did not comprehensively develop plans to ensure the continuity of its operations.

We and inspectors general have made numerous recommendations aimed at improving information security programs and practices over the years. Until these agencies take action to address deficiencies in implementing the eight elements of an agency-wide information security program, they lack assurance that their information systems and networks are protected from inadvertent or malicious activity.

Inspectors General Determined That the 24 CFO Act Agencies Generally Did Not Have Effective Information Security Policies and Practices

Inspectors general determined that few agencies covered by the CFO Act of 1990 had effective agency-wide information security programs during fiscal year 2018. Further, in agency financial statement audit reports for fiscal year 2018, inspectors general reported that they continued to identify significant deficiencies in information security controls over financial systems. As a result, inspectors general reported material weaknesses or significant deficiencies in internal control over financial reporting for fiscal year 2018.

Inspectors General Indicate That Few CFO Act Agencies had Effective Information Security Programs

FISMA requires inspectors general to determine the effectiveness of their respective agencies’ information security programs. To do so, OMB instructed inspectors general to provide a maturity rating for agency information security policies, procedures, and practices related to the five core security functions established in the NIST cybersecurity framework, as well as for the agency-wide information security program.

For fiscal year 2018, the inspectors general for only six of the 24 CFO Act agencies reported that their agencies had an effective agency-wide information security program. However, the remaining 18 agencies were reported as having ineffective information security programs. When considering each of the five core security functions, most inspectors general reported that their agency was at Level 3 (consistently implemented) for the Identify, Protect, and Recover functions; at Level 2 (defined) for the Detect function; and at Level 4 (managed and measurable) for the Respond function, as shown in figure 9.

Agency inspectors general report on the effectiveness of agencies’ information security controls as part of the annual audits of the agencies’ financial statements. The reports resulting from these audits include a description of information security control deficiencies related to the five major control categories defined by the Federal Information System Controls Audit Manual (FISCAM)—security management, access controls, configuration management, segregation of duties, and contingency planning.

For fiscal year 2018, inspectors general identified information security control deficiencies related to most of the FISCAM general control categories for most of the 24 CFO Act agencies as shown in figure 10.

Overall, inspectors general for the 24 CFO Act agencies continued to report deficiencies in agencies information security practices for fiscal year 2018. Specifically, during that time, 18 inspectors general designated information security as either a material weakness (6) or significant deficiency (12) in internal control over financial reporting systems for their agency. Further, inspectors general at 21 of the 24 agencies cited information security as a major management challenge for their agency for fiscal year 2018.

Most of the 23 Civilian CFO Act Agencies Reported Not Fully Meeting Targets for Implementing Cyber Capabilities to Mitigate Risks

OMB, in its fiscal year CIO reporting metrics, directed CIOs to assess their agencies’ progress toward achieving outcomes that strengthen federal cybersecurity. To do this, CIOs evaluated their agency’s performance in reaching targets for meeting key milestones of the current administration’s IT Modernization Cross-Agency Priority (CAP) goal. This CAP goal includes a cybersecurity initiative to mitigate the impact of risks to federal agencies’ data, systems, and networks by implementing cutting edge cybersecurity capabilities.

The CAP goal’s cybersecurity initiative has three strategies that include key milestones with specific implementation targets, most of which are expected to be met by the end of fiscal year 2020. Table 4 shows the key milestones and targets related to the three strategies of the IT Modernization CAP goal’s cybersecurity initiative, as well as how many agencies were meeting the targets for each of the milestones.

Overall, only two of the civilian 23 CFO Act agencies met all 10 targets for the cybersecurity initiative of the IT Modernization CAP goal, during fiscal year 2018. Whereas, 10 agencies met seven to nine of the targets and the remaining 11 agencies met six or fewer targets. More specifically, by strategy area,

Seven agencies met all four targets for the manage asset security strategy.

Eight agencies met all three targets for the limit personnel security strategy.

Seven agencies met all three targets for the protect networks and data strategy.

OMB, DHS, and NIST Acted to Fulfill Their FISMA-defined Roles, but Shortcomings Exist in Government- wide Efforts Intended to Improve Federal Information Security

OMB, DHS, and NIST have ongoing and planned initiatives to support FISMA’s implementation across the federal government. Specifically, OMB developed and oversaw the implementation of information security policies, procedures, and guidelines over the past 2 years. In addition, DHS oversaw and assisted government efforts that were intended to provide adequate, risk-based, cost-effective cybersecurity. Further, NIST continued to provide guidance to federal agencies to improve information security across the government.

However, beyond fiscal year 2016, OMB held CyberStat meetings at significantly fewer agencies. These meetings are intended to help ensure effective implementation of information security policies and practices. In addition, OMB’s guidance to agencies for preparing their fiscal year 2018 FISMA report does not sufficiently address FISMA’s requirement for developing subordinate plans for providing adequate information security for networks, facilities, and information systems.

OMB Provided Guidance for Federal Information Security, but Missed a Reporting Deadline and Its Reporting Guidance to Agencies Did Not Sufficiently Address a FISMA Element

FISMA requires that OMB submit a report to Congress no later than March 1 of each year on the effectiveness of agencies’ information security policies and practices during the preceding year. This report is to include: a summary of incidents described in the agencies’ annual reports; a description of the threshold for reporting major information security a summary of results from the annual IG evaluations of each agency’s information security program and practices; an assessment of each agency’s compliance with NIST information an assessment of agency compliance with OMB data breach notification policies and procedures.

As of June 2019, OMB had not issued its annual FISMA report to Congress for fiscal year 2018. OMB officials stated that the lapse in appropriations during the start of 2019 caused a delay in the report’s development and release. The officials declined to provide a time frame for when they expected to issue the report.

OMB Provided Numerous Guidance Documents to Agencies and Monitored Agencies’ Implementation of Them

FISMA requires OMB to develop and oversee the implementation of policies, principles, standards, and guidelines on information security. Since the start of fiscal year 2018, OMB has developed or proposed policies and generally monitored their implementation. Specifically: In May 2019, OMB issued policy to address federal agencies’ implementation of identity, credential, and access management (ICAM). Among other things, the policy requires agencies to (1) implement identity, credential, and access management guidelines, standards, and directives issued by NIST, DHS, and the Office of Personnel Management; and (2) harmonize their enterprise-wide approach to ICAM governance, architecture, and acquisition through activities such as designating an integrated agency-wide ICAM governance structure and establishing solutions for ICAM services that are flexible and scalable.

In December 2018, OMB issued a memorandum on the high-value asset (HVA) program that (1) outlined agency expectations for establishing agency governance; (2) required agencies to take action to improve the identification of HVAs; and (3) defined agency reporting, assessment, and remediation requirements for HVAs. In March 2018, OMB reported that agencies’ continued to have challenges in mitigating security vulnerabilities identified across the federal HVA landscape in its fiscal year 2017 FISMA report to Congress. In addition, OMB required agencies to report on the implementation of security controls to protect HVAs during fiscal year 2018.

In October 2018, OMB issued new federal information security and privacy management guidance that required agencies to (1) report on the adequacy and effectiveness of their information security programs, (2) submit a current and prioritized list of HVAs through the Homeland Security Information Network, and (3) report major incidents to DHS, OMB, Congress and their agency inspectors general. In addition, the guidance required agencies to ensure that DHS has authorization and the information necessary to monitor and provide technical assistance related to vulnerability scanning.

OMB Assessed and Reported on Agencies’ Implementation of Federal Information Security Requirements, but the Number of Agencies Scheduled to Participate in CyberStat Meetings Has Declined over the Last 3 Years

In addition to developing and monitoring the implementation of information security policies, FISMA directs OMB to oversee agencies’ compliance with the act’s requirements to provide information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, modification, or destruction of information or information systems. During fiscal year 2018, OMB issued four reports summarizing government-wide implementation of the information security requirements, as described below: In September 2018, OMB issued an assessment of intrusion detection and prevention capabilities across the federal enterprise. In its assessment, OMB briefly described federal agencies’ implementation of intrusion detection and prevention capabilities through DHS’s EINSTEIN sensor suite.

In May 2018, OMB issued its Federal Cybersecurity Risk Determination Report and Action Plan. For this report, OMB evaluated risk management assessment reports for 96 agencies and described actions that it and agencies plan to take to address government-wide cybersecurity gaps. Two major actions discussed in the report are: (1) federal agencies must consolidate their security operations center capabilities and processes, or migrate the security operations center as a service; and (2) OMB, DHS, and other federal agencies are to assist with implementing the cyber threat framework developed by the Office of the Director of National Intelligence.

In March 2018, OMB issued its annual FISMA report to Congress for fiscal year 2017, which summarized the performance of 97 agencies in implementing effective information security programs and managing risk, among other things.

In December 2017, OMB released its Report to the President on Federal IT Modernization, which outlined a vision and recommendations for the federal government to build a more modern and secure architecture for federal systems. For example, OMB described government-wide initiatives intended to improve the security of federal networks that emphasized perimeter network- based security protections, but had gaps in the application and data- level protections needed to provide complete security. To address these deficiencies, OMB recommended a layered defensive strategy in government-wide programs to provide greater defense-in-depth capabilities that are intended to prevent malicious actors from moving laterally across linked networks to access valuable information.

Number of Agencies Scheduled for CyberStat Meetings Significantly Declined Since Fiscal Year 2016 OMB, in coordination with DHS, is responsible for coordinating CyberStat review meetings. As mentioned previously, FISMA requires OMB to oversee agency compliance with requirements to provide information security protections on information and information systems. One means of fulfilling this oversight responsibility is through CyberStat engagements. For these engagements, OMB, in coordination with DHS, intends to engage agency leadership on Administration priorities and perform outreach to ensure that agencies are taking the appropriate actions to strengthen their cybersecurity posture.

However, since our September 2017 report on fiscal year 2016 FISMA implementation, the number of agencies that have participated in a CyberStat engagement has significantly declined. In fiscal year 2016, OMB scheduled these engagements with 24 agencies to help develop action items that address information security risk, identify areas for targeted assistance, and track performance at the agencies throughout the year. The number of agencies scheduled to participate in an engagement decreased to five during fiscal year 2017, and decreased further to three during fiscal year 2018. As of May 2019, OMB staff in the Office of the Federal CIO informed us that the agency had not scheduled any agencies to participate in a CyberStat engagement during fiscal year 2019.

According to OMB officials in the Office of the Federal CIO, updates to the CyberStat process resulted in extended engagements between DHS, OMB, and the agencies that lasted 4 to 6 weeks or more. Beginning in fiscal year 2017, according to DHS’s CyberStat concept of operations, OMB and DHS took a collaborative approach with the CyberStat process. Specifically, officials from the participating agencies, OMB’s Cyber and National Security Unit, and DHS’s Federal Network Resilience (FNR) division collaborated through these CyberStat engagements to reach a desired performance outcome at the participating agencies.

DHS’s CyberStat concept of operations states that the department focuses on agency performance in key federal information security reporting, including agency FISMA reporting, DHS reports of agency compliance with binding operational directives, and reports issued by GAO and agency inspectors general. A DHS official from the department’s FNR division informed us that it uses these information security reports to make recommendations to OMB, who then decides which agencies will be scheduled to participate in a CyberStat engagement. According to OMB, the three agencies that participated in a CyberStat engagement initiated during fiscal year 2018 volunteered to do so after discussing their cybersecurity implementation issues with OMB.

However, as discussed earlier in this report, deficiencies reported in agency fiscal year 2018 FISMA reports and information security evaluation reports issued by GAO and inspectors general for fiscal year 2018 indicate that several agencies are in need of OMB and DHS assistance to improve their information security posture. In addition, the three agencies that participated in CyberStat engagements scheduled during fiscal year 2018 saw value in changes resulting from the updated engagement process. For example, officials from the Office of the CIO (OCIO) at one of the three agencies stated that the updated process was more constructive and valuable than the prior CyberStat process that was based more on a compliance checklist. In addition, OCIO officials at all three agencies stated that the process helped improve their agencies’ information security posture and that their collaboration with OMB and DHS was beneficial to assisting with FISMA implementation.

By conducting fewer CyberStat engagements with agencies, OMB loses an opportunity to assist agencies with improving their information security posture. Additionally, OMB will limit its ability to oversee specific agency efforts to provide information security protections for federal information and information systems.

Inspector General Reporting Metrics Did Not Sufficiently Cover System Security Plans

FISMA includes reporting requirements for OMB, agency CIOs and inspectors general. According to OMB’s FISMA reporting guidance, OMB and DHS collaborate with interagency and inspector general partners to develop the CIO and inspector general metrics, which are intended to facilitate agencies’ compliance with FISMA-related reporting requirements. These entities created separate sets of reporting metrics for agency CIOs and agency inspectors general.

However, the inspector general reporting metrics did not specifically address the development and maintenance of system security plans, although subordinate plans, such as system security plans, are a key element of an agency-wide information security program required by FISMA.

OMB officials in the Office of the Federal CIO informed us that, while they work in coordination with CIGIE to establish the reporting metrics, CIGIE is ultimately responsible for developing the metrics. According to both the published metrics and OMB’s guidance memorandum, OMB collaborates with DHS and inspector general partners to develop the IG FISMA metrics. According to representatives from CIGIE, the existence of system security plans is addressed in multiple questions within the reporting metrics, which is in alignment with OMB’s focus toward ongoing assessments and authorizations.

Nevertheless, our review of the reporting metrics and supplemental evaluation guide did not identify any reference to the development and maintenance of system security plans. The lack of a defined reporting metric for addressing agency system security plans could lead to inconsistent reporting by inspectors general. Until such a metric is developed and reported on, OMB will not have reasonable assurance that inspectors general evaluations appropriately address each of the required elements of an information security program.

DHS Continued to Issue Cybersecurity-related Directives and Assist Agencies by Providing Common Security Capabilities

Under FISMA, DHS, in consultation with OMB, is responsible for carrying out various activities, including developing and overseeing the implementation of binding operational directives and providing operational and technical assistance to agencies.

Over the last 2 years, DHS had developed four binding operational directives as of April 2019, as required by FISMA. These directives instructed agencies to: remove and discontinue use of all present and future Kaspersky- branded products; enhance email security by adopting domain-based message authentication, reporting and conformance (DMARC) to prevent email spoofing and web security by ensuring all publicly accessible federal websites provides services through a secure connection; submit a current and prioritized high-value asset list to DHS and if selected, participate in risk and vulnerability assessments; and review and remediate critical and high vulnerabilities on internet- facing systems within 15 and 30 calendar days of initial detection, respectively.

We have ongoing work evaluating DHS’s process to develop and oversee the implementation of binding operational directives as part of another engagement. We will report on the results of this evaluation in a separate report.

DHS also provided operational and technical assistance to agencies through its Continuous Diagnostics and Mitigation (CDM) and National Cybersecurity Protection System (NCPS) programs. DHS is taking steps to deploy the CDM and NCPS capabilities to all participating federal agencies to enhance detection of cyber vulnerabilities and protection from cyber threats.

Continuous Diagnostics and Mitigation program (CDM). The program is to provide federal departments and agencies with commercial off-the- shelf capabilities and tools that identify cybersecurity risks on an ongoing basis, prioritize these risks based upon potential impacts, and enable cybersecurity personnel to mitigate the most significant problems first. In December 2018, we reported that the department was in the process of enhancing the capabilities of federal agencies to automate network monitoring for malicious activity through its CDM program.

In our December report, we also recommended that DHS coordinate further with federal agencies to identify training and guidance needs for implementing CDM. DHS plans to complete implementation of our recommendation this fiscal year. In addition, we have an ongoing review to evaluate the extent to which selected agencies have effectively implemented CDM and to identify practices for effective and efficient implementation of the program. We will report on the results of this review separately.

National Cybersecurity Protection System (NCPS). The program is one of the tools to aid federal agencies in mitigating information security threats. The system is intended to provide DHS with the capability to provide four cyber-related services to federal agencies: intrusion detection, intrusion prevention, analytics, and information sharing.

In January 2016, we made nine recommendations to further improve NCPS capabilities by, among other things, developing metrics that clearly measure the effectiveness of NCPS’s efforts, including the quality, efficiency, and accuracy of actions related to detecting and preventing intrusions, providing analytic services, and sharing cyber-related information. As of June 2019, DHS had implemented six of our nine recommendations and plans to implement the remainder by the end of this fiscal year.

NIST Continues to Provide Information Security Guidance to Agencies

According to FISMA, NIST is to develop information security standards and guidelines, in coordination with OMB and DHS. Specifically, NIST’s Computer Security Division is responsible for developing cybersecurity standards, guidelines, tests, and metrics for the protection of federal information systems.

NIST has developed information security guidelines for federal agencies. Specifically, in April 2018, NIST issued an update to its cybersecurity framework that it originally issued in February 2014. Although the cybersecurity framework was initially intended for critical infrastructure, Executive Order 13800 requires federal agencies to use the cybersecurity framework to also manage their cybersecurity risk. The revised framework includes a new section on cybersecurity measurement; an expanded explanation of using the framework for cyber supply chain risk management; refinements to authentication, authorization, and identity proofing policies within access controls; and a new section on using the cybersecurity framework to understand and assess an organization’s cybersecurity risk.

In May 2017, NIST published draft guidance for agencies to use in implementing the cybersecurity framework. This publication is intended to provide guidance on the use of the framework in conjunction with the current and planned suite of NIST security and privacy risk management publications, such as NIST Special Publication 800-53. According to NIST officials in the agency’s Computer Security Division, the agency is in the process of finalizing the implementation guidance and plans to publish the final version by the end of fiscal year 2019.

Further, in December 2018, NIST released the revised Risk Management Framework for Information Systems and Organizations (risk management framework). According to NIST, the update provides an integrated, robust, and flexible methodology to address security and privacy risk management. Among the changes in the updated version is the integration of privacy risk management into the existing information security risk management processes. In addition, the risk management framework includes direct references to the cybersecurity framework, which demonstrates how organizations that implement the risk management framework can also achieve the outcomes of the cybersecurity framework.

In April 2019, NIST released revised guidance on vetting the security of mobile applications. According to NIST, the revised publication provides guidance for planning and implementing a mobile application vetting process, developing security requirements for mobile applications, identifying appropriate tools for testing mobile applications, and determining if a mobile application is acceptable for deployment on an organization’s mobile devices.

In addition, NIST is currently developing a privacy framework to help improve agencies’ privacy risk management. In April 2019, NIST issued a discussion draft for its privacy framework. According to the discussion draft, NIST will use feedback received on the discussion draft to develop a preliminary draft of the privacy framework, which is intended to assist organizations in identifying, assessing, and responding to privacy risks. Further, the framework is intended to foster the development of innovative approaches to protecting individuals’ privacy and increase trust in systems, products and services. According to NIST officials, the agency continues to engage stakeholders, both nationally and internationally, through roundtable meetings, webinars, and public workshops to solicit stakeholder input to inform development of this framework. NIST’s website states that the agency anticipates publishing the privacy framework in October 2019.

Conclusions

Federal agencies continued to have deficiencies in implementing information security programs and practices. Inspectors general reported that 18 of 24 CFO Act agencies did not have effective agency-wide information security programs in fiscal year 2018. In addition, most of the selected agencies had deficiencies in the five core security functions. We and the inspectors general have made thousands of recommendations aimed at improving information security programs and practices over the years. Implementation of these recommendations will assist agencies in strengthening their information security policies and practices.

OMB, DHS, and NIST have issued directives and guidance and implemented programs that, to some extent, have improved agencies’ security posture. However, OMB has not issued its report to Congress on the effectiveness of agencies’ information security policies and practices for fiscal year 2018, although the report was due several months ago. Further, while agencies indicated that the collaborative CyberStat engagements with DHS and OMB have aided with their FISMA implementation, the number of these engagements has declined significantly. In addition, the OMB-approved metrics that inspectors general use to evaluate FISMA implementation do not include one of the elements—system security plans—required by FISMA for information security programs. By not including this element, oversight of agencies’ information security programs has been diminished.

Recommendations for Executive Action

We are making the following three recommendations to OMB: The Director of OMB should submit the statutorily required report to Congress on the effectiveness of agencies’ information security policies and practices during the preceding year. (Recommendation 1)

The Director of OMB should expand its coordination of CyberStat review meetings for those agencies with a demonstrated need for assistance in implementing information security. (Recommendation 2)

The Director of OMB should collaborate with CIGIE to ensure that the inspector general reporting metrics include the FISMA-required information security program element for system security plans. (Recommendation 3)

Agency Comments and Our Evaluation

We provided a draft of this report to OMB and the 28 selected agencies for review and comment. In response, OMB provided comments orally and via email in which the office, respectively, generally concurred with our first two recommendations and concurred with a revised version of our third recommendation.

Specifically, in oral comments, officials in the Office of the Federal Chief Information Officer noted actions that they said OMB plans to take to address our first two recommendations. According to these officials, the office plans to issue its fiscal year 2018 report to Congress on the effectiveness of agencies’ information security policies and practices in the near future. In addition, the office plans to continue to collaborate with DHS to identify information security gaps at agencies and work with agencies to address those gaps in CyberStat meetings or by other means.

With regard to our third recommendation, the officials expressed concern with the wording of the recommendation in our draft report, which related to OMB updating the IG metrics. They noted that CIGIE, rather than OMB, is responsible for updating these metrics. Accordingly, we revised the recommendation to emphasize the need for OMB to collaborate with CIGIE.

In a subsequent email from our OMB liaison, the office concurred with the revised recommendation. The office emphasized its plans to continue working collaboratively with the inspector general community to assist with improving and evolving the metrics to ensure that the metrics address FISMA requirements.

OMB also provided technical comments, which we incorporated, as appropriate.

In addition, five of the 28 selected agencies provided written responses regarding the draft report: In its response (reprinted in appendix III), the Department of Housing and Urban Development stated that it had reviewed our draft report and had no comments.

In its comments (reprinted in appendix IV), the Department of Veterans Affairs stated that it remains committed to complying with the requirements of FISMA and to safeguarding the department’s systems and data, which support the delivery of care, benefits, and services to veterans. The department also stated that it continues to prioritize efforts to address our prior information security-related recommendations to the department.

In its response (reprinted in appendix V), the Environmental Protection Agency stated that it had reviewed our draft report and had no comments.

In its comments (reprinted in appendix VI), the Social Security Administration stated that it will continue to improve its cybersecurity safeguards and looks forward to receiving additional guidance to assist the agency with its efforts.

In its comments (reprinted in appendix VII), the U.S. Agency for International Development stated that it has developed, documented, and implemented an agency-wide program to provide security for its information and systems, pointing out that its inspector general reported that the agency had an effective program in fiscal year 2018. The agency also cited its commitment to continuing compliance with FISMA’s requirements and to safeguarding its information technology services to facilitate its mission.

Further, four of the selected agencies—the Departments of Commerce, Homeland Security, and Transportation, as well as the National Science Foundation—also provided technical comments which we have incorporated in the report, where appropriate.

The remaining 19 selected agencies provided emails stating that they had no comments on the report. These agencies were the Departments of Agriculture, Defense, Education, Energy, Health and Human Services, the Interior, Justice, Labor, State, and the Treasury; and the Federal Communications Commission; Federal Retirement Thrift Investment Board; General Services Administration; Merit System Protection Board; National Aeronautics and Space Administration; Nuclear Regulatory Commission; Office of Personnel Management; Presidio Trust; and Small Business Administration.

We are sending copies of this report to appropriate congressional committees, the Director of OMB, the heads of the CFO Act agencies and their inspectors general, the heads of four selected non-CFO Act agencies, and other interested congressional parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VIII.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) describe the reported adequacy and effectiveness of selected federal agencies’ information security policies and practices and (2) evaluate the extent to which the Office of Management and Budget (OMB), the Department of Homeland Security (DHS), and the National Institute of Standards and Technology (NIST) have implemented their government-wide Federal Information Security Modernization Act of 2014 (FISMA) requirements.

To describe the reported adequacy and effectiveness of federal agencies’ information security policies and practices, we analyzed our, agency, and inspectors general information security-related reports for 16 selected agencies. Our selection of 16 agencies included 12 Chief Financial Officers (CFO) Act of 1990 agencies and four non-CFO Act agencies. To select the 12 CFO Act agencies, we first ranked the 23 civilian CFO Act agencies by the number of information security systems each agency reported operating in fiscal year 2017. We then separated the agencies into large, medium, and small categories based on the number of systems they reported, and selected four agencies from each category using a random number generator. To select the four non-CFO Act agencies, we listed the 73 non-CFO Act agencies reported in OMB’s annual FISMA report to Congress for fiscal year 2017 and then randomly selected four agencies. Although we randomly selected agencies and assured we had CFO Act and non-CFO Act agencies, due to the small number of agencies examined, results based on these agencies do not generalize beyond the agencies reviewed.

The 16 agencies were the Departments of the Agriculture, Commerce, Education, Housing and Urban Development, Justice, Labor, State, and the Treasury; the Environmental Protection Agency; Federal Communications Commission; Federal Retirement Thrift Investment Board; Merit Systems Protection Board; National Aeronautics and Space Administration; Presidio Trust; Small Business Administration; and the Social Security Administration. For these agencies, we analyzed, categorized, and summarized weaknesses identified in inspector general and GAO reports using the NIST Framework for Improving Critical Infrastructure Cybersecurity (cybersecurity framework) core security functions and the eight elements of information security programs required by FISMA.

In addition, for the 24 agencies covered by the CFO Act, we summarized (1) the inspector general ratings of agency-wide information security programs and (2) the inspector general designation of information security as a significant deficiency or a material weakness for financial reporting systems as reported for fiscal year 2018. For the 23 civilian agencies covered by the CFO Act, we summarized fiscal year 2018 agency Chief Information Officer (CIO) reports of their agency’s progress in meeting targets for implementing cyber capabilities supporting the Administration’s cybersecurity-related Cross-Agency Priority (CAP) goal.

To gain insight into how agencies collect, report, and ensure the accuracy and completeness of the FISMA data they report, we analyzed documentation describing and supporting the processes at eight of the 16 selected agencies to ensure the accuracy and completeness of those data. We also interviewed officials at the eight agencies to obtain additional information on the quality controls implemented on the system used for FISMA reporting. The eight agencies selected were the Departments of Education, Justice, Labor, and the Treasury; the Federal Communications Commission; National Aeronautics and Space Administration; Presidio Trust; and the Small Business Administration. These agencies were randomly selected from the list of 16 agencies described above. Based on our assessment, we determined that the data were sufficiently reliable for the purpose of our reporting objectives.

To evaluate the extent to which OMB, DHS, and NIST have implemented FISMA requirements, we analyzed the FISMA provisions to identify federal responsibilities for OMB, DHS, and NIST. We evaluated documentation of these agencies’ government-wide responsibilities to determine if the agencies were meeting FISMA requirements, including documentation obtained from their websites. Specifically, for OMB, we collected and reviewed information security-related policies and guidance that it issued since we last reported in September 2017. We also obtained reports issued by OMB to determine the extent to which the agency had overseen the policies and guidelines it issued, as well as other agency efforts for improving information security. In addition, we analyzed fiscal year 2018 inspector general and CIO FISMA reporting metrics to determine if the metrics sufficiently addressed the agency-wide information security program elements required by FISMA. We also interviewed OMB officials to obtain information on any actions they have planned or taken to improve the information security posture of the federal government.

Further, we interviewed OMB and DHS officials to understand their process for scheduling CyberStat engagements with senior agency officials. We also interviewed officials at the three agencies that participated in a CyberStat engagement initiated during fiscal year 2018 to understand the benefits and challenges of their collaboration with OMB and DHS.

For DHS, we reviewed and summarized a recently issued GAO report describing updates to the department’s Continuous Diagnostic and Mitigation Program and National Cybersecurity Protection System. We also collected and summarized the binding operational directives issued by DHS over the last 2 years. Further, we interviewed DHS officials to obtain information on any actions they have planned or taken to improve the information security posture of the federal government.

For NIST, we collected and summarized the standards and guidance issued or updated by the agency since the start of fiscal year 2018. We also interviewed NIST officials and obtained information on draft standards and guidance to describe NIST’s current and planned efforts to help improve the information security posture of the federal government.

We conducted this performance audit from December 2018 to July 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Cybersecurity Framework

The National Institute of Standards and Technology established the cybersecurity framework to provide guidance for cybersecurity activities within the private sector and government agencies at all levels. The cybersecurity framework consists of five core functions: identify, protect, detect, respond, and recover. Within the five functions are 23 categories and 108 subcategories that define discrete outcomes for each function, as described in table 5.

Appendix III: Comments from the Department of Housing and Urban Development

Appendix IV: Comments from the Department of Veterans Affairs

Appendix V: Comments from the Environmental Protection Agency

Appendix VI: Comments from the Social Security Administration

Appendix VII: Comments from the U.S. Agency for International Development

Appendix VIII: GAO Contacts and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the individual named above, Jeffrey Knott (assistant director), Di’Mond Spencer (analyst-in-charge), Andrew Ahn, Chris Businsky, Fatima Jahan, and Priscilla Smith made key contributions to this report.