Information Security: Agencies Need to Improve Oversight of Contractor Controls
Released: 2014-09-08T00:00:00

Letter

Background

The use of IT is pervasive in the federal government as agencies have become dependent on computerized information systems and electronic data to carry out operations and to process, maintain, and report information. As our past work has shown, protecting federal systems and the information on them is essential because the loss or unauthorized disclosure or alteration of the information can lead to serious consequences and can result in substantial harm to individuals and the federal government. Specifically, ineffective protection of IT systems and information can result in threats to national security, economic well-being, and public health and safety; loss or theft of resources, including money and intellectual property; inappropriate access to and disclosure, modification, or destruction of sensitive information; use of computer resources for unauthorized purposes or to launch an attack on other computer systems; damage to networks and equipment; loss of public confidence; and high costs for remediation.

While some incidents can be resolved quickly and at minimal cost, others may go unresolved and result in significant costs.

Agencies Rely on Contractors to Operate and Secure Systems

Federal agencies rely extensively on contractors to provide IT services and operate systems to help carry out their missions. For example, we reported that in fiscal year 2012, the Department of Defense obligated approximately $360 billion for contracts for goods and services, such as information technology and weapon systems maintenance. The ability to contract for technology services can allow an agency to obtain or offer enhanced services without the cost of owning the required technology or maintaining the human capital required to deploy and operate it. Specifically, contractors and their employees provide services and systems to agencies at agency and contractor facilities, directly and by remote access. Services can include computer and telecommunication systems and services, and testing, quality control, installation, and operation of computer equipment.

Federal Laws, Regulations, and Guidance Provide a Framework for Protecting the Privacy and Security of Information and Systems

Federal laws require agencies to protect the privacy and security of federal data and information systems. To help protect against threats to federal systems, FISMA sets forth a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets, including those operated by contractors on behalf of the agency. It requires each agency to develop, document, and implement an information security program that includes the following components: periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; policies and procedures that are (1) are based on risk assessments, (2) cost-effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements; subordinate plans for providing adequate information security for networks, facilities, and systems or group of information systems, as appropriate; security awareness training to inform personnel, including contractors, of information security risks and of their responsibilities in complying with agency policies and procedures designed to reduce these risks, as well as training personnel with significant security responsibilities for information security; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of information systems; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency.

Under FISMA, each agency CIO has the responsibility to ensure that agency information and information systems, including those operated by contractors, are being protected under the agency’s information security program. In addition, OMB’s annual FISMA reporting instructions require agencies to develop policies and procedures for agency officials to follow when performing oversight of the implementation of security and privacy controls by contractors.

FISMA requires each agency to have an annual independent evaluation of its information security program and practices, including controls testing and compliance assessment. OMB guidance specifically requires each agency inspector general, or other independent auditor, to perform the evaluation, including the effectiveness of the agency’s contractor oversight. Additionally, inspectors general are to evaluate agency efforts in providing oversight of contractor employees who have privileged access to federal data and information systems.

In addition to establishing responsibilities for agencies, FISMA assigns specific information security responsibilities to OMB and NIST:

OMB is to develop and oversee the implementation of policies, principles, standards, and guidelines on information security in federal agencies. It is also responsible for reviewing, at least annually, and approving or disapproving agency information security programs. Further, OMB is to report annually to Congress on the implementation of FISMA by the agencies.

NIST’s responsibilities include developing security standards and guidelines for agencies (other than for national security systems) that include standards for categorizing information and information systems according to ranges of risk levels, minimum security requirements for information and information systems in risk categories, guidelines for detection and handling of information security incidents, and guidelines for identifying an information system as a national security system.

The Privacy Act of 1974 limits how federal agencies collect, disclose, or use personal information. Under this act, agencies are to, among other things, establish appropriate safeguards to ensure the security and confidentiality of personal information maintained in a system of records and protect it against anticipated security or integrity threats or hazards. The Privacy Act’s requirements also apply to government contractors and contractor employees who have access to or maintain agency systems of records that contain personally identifiable information. The Privacy Act requires that when agencies establish or make changes to a system of records, they must notify the public through a system-of-records notice in the Federal Register which includes the system safeguards for the security and confidentiality of personal information.

Pub. L. No. 107-347 § 208 (Dec. 17, 2002); 44 U.S.C. § 3501 note. agencies must conduct PIAs before developing or procuring information technology that collects, maintains, or disseminates information that is in a personally identifiable form. In conducting PIAs, agencies are to ensure that the handling of the information conforms to applicable privacy legal requirements, determine risks, and examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks.

Agency Assessments of Contractor-Operated Systems are Designed to Ensure that Federal Requirements are Met

To ensure that contractor-operated systems meet federal information security and privacy requirements, the Federal Acquisition Regulation (FAR) requires that agency acquisition planning for IT comply with the information technology security requirements in FISMA, OMB’s implementing policies including Appendix III of OMB Circular A-130, and NIST guidance and standards. The FAR addresses application of the Privacy Act to contractors at subpart 24.1, Protection of Individual Privacy.

NIST Special Publications 800-53 and 800-53A guide agencies in selecting security and privacy controls for systems and assessing them to ensure that the selected controls are in place and functioning as expected. Additional NIST special publications on IT security services and risk management (Special Publications 800-35 and 800-37) identify several key activities important to contractor oversight for assessing the security and privacy controls of information systems. The key activities and the steps included in each are shown in table 3.

The FAR establishes uniform policies and procedures for acquisition of supplies and services by executive agencies. The FAR and agency supplements are codified in title 48 of the Code of Federal Regulations. As relevant here, the FAR’s acquisition planning requirements for IT security are at 48 C.F.R. § 7.103(w). See also, FAR § 7.105(b)(16)(Government-furnished information) and (18)(Security considerations).

NIST Special Publication 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, (Gaithersburg, MD: Apr. 2013) and NIST Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, (Gaithersburg, MD: Jun. 2010).

GAO has Previously Reported on Agencies’ Oversight of Contractors

In April 2005, we reported on federal agencies’ implementation of FISMA requirements and their oversight of contractors and others with privileged access to federal data and systems. We determined that, although most agencies reported having written policies that addressed information security for contractor-provided IT services and systems, few had established specific policies for overseeing the information security practices of contractors and contractor employees to ensure compliance with contract requirements and agency information security policies. We concluded that, without specific oversight policies establishing when and how agencies will review contractor-operated systems, officials responsible for the systems may not be taking sufficient action to ensure that security requirements are being met. We recommended, among other things, that the Director of OMB ensure that federal agencies develop policies for ensuring the information security of contractors and other users with privileged access to federal data. Subsequently OMB modified its instructions to better ensure that federal agencies develop policies for ensuring the information security provided by contractor employees.

Agency Oversight of Contractor-Operated Systems Was Not Always Consistent

Under FISMA, each agency CIO has the responsibility to ensure that agency information and information systems, including those operated by contractors, are being protected under the agency’s information security program. In addition, OMB’s annual FISMA reporting instructions require agencies to develop policies and procedures for agency officials to follow when performing oversight of the implementation of security and privacy controls by contractors. CIO oversight of the agency’s information security program provides agency officials assurance that they are protecting sensitive agency information. According to NIST, assessment of security and privacy controls is a key element of security program oversight.

While the six agencies we reviewed generally established security and privacy requirements for contractors to follow and prepared for assessments to determine the effectiveness of contractor implementation of controls, five of the six were inconsistent in overseeing the execution and review of those assessments. Table 4 details the degree of implementation of oversight activities for the selected systems at each agency.

While agencies performed two of the eight key steps in all cases, most were inconsistent in performing the remaining steps for the oversight of the selected contractor-operated systems. Specifically:

Communicate requirements to contractors. Four of the six agencies (DOE, DHS, EPA, and OPM) communicated security and privacy requirements to contractors in contracts for the systems we reviewed. For example, a contract for one system at EPA specifically required the contractor to comply with the EPA information security policy. Two of the six agencies (DOT and State) did not always communicate security and privacy requirements to contractors in the contracts for agency systems. NIST guidance states that security requirements should be stated explicitly or by reference in contracts. However, while State’s departmental policies include references regarding contractor requirements for protecting personally identifiable information and system authorization, the contract for one system that we reviewed did not contain language that communicated these requirements. Furthermore, while the contract for one of the systems at DOT was modified to include requirements for background investigations, there was no language included that communicated agency security and privacy requirements. Officials for both agencies were not able to explain why this language was not included in the contracts. Without specific security requirements in the contract, these two systems are at an increased risk that contractors may not understand the requirements that they are expected to implement or cannot be held to the security and privacy requirements during contract performance.

Select and document security and privacy controls. All 12 of the systems that we reviewed documented the security and privacy controls that were expected to be implemented for the system within the system security plan. According to NIST Special Publication 800- 37, system security plans are intended to provide an overview of the security requirements for the system and describe the security controls in place or planned for meeting those requirements. Each agency supported the selection of controls by documenting privacy risks and impacts to the systems we reviewed within a PIA, as called for when systems contain personally identifiable information.

Select an independent assessor. Five of the six agencies ensured that assessors used for systems we reviewed were independent, as required by NIST. For moderate impact information systems and higher, such as the ones that we reviewed, NIST states that an independent third party reviewer should be used for the assessment to ensure that the review is unbiased. For example, for both systems we reviewed at OPM, the agency used a different contractor to assess the system and system officials took steps to verify that the assessor was independent. However, one agency, State, did not ensure that the assessors used for both systems we reviewed were independent. State officials allowed the contractor to select the assessor for both systems we reviewed and did not take steps to verify the assessor’s independence. State officials stated that they believe it was not their responsibility to ensure the independence of the assessors for the particular systems. As a result, the agency has reduced assurance that assessments were complete and unbiased.

Develop a test plan. Five of the six agencies adequately documented test plans for the assessments of the two systems we reviewed at each agency. These plans documented the controls to be tested and appropriate assessment procedures. NIST Special Publication 800- 53A states that test plans are to document the objectives for the security control assessment and provide a detailed road map of how the assessors are to test the information security and privacy controls for the system. One of the six agencies (DOE) did not document which controls from the system security plan were to be tested and the assessment procedures that were to be followed for one system as the officials could not locate the system test plan. DOE officials stated that the computer housing the information became corrupted and the detailed test plan could therefore not be provided.stated that, in response to our audit, they now plan to expedite the development of a test plan to be executed this year. Without a detailed test plan, agency officials have reduced assurance that the selected controls were tested and that the correct tests were executed.

Execute the test plan. One of the six agencies (DHS) effectively executed the test plan for the two systems we reviewed. For both of its systems, the controls from the test plan, were effectively tested, and for areas such as background investigation and contingency plan training evidence was provided showing that all of the contractors operating the system had received an investigation or training. NIST guidance calls for agencies to ensure that the test plan is appropriately executed during the assessment process.

However, the system assessments that were performed by five of the six agencies (DOE, DOT, EPA, OPM, and State) were not always effective. For example, DOT and State did not always ensure that system assessments evaluated the extent to which background investigations had been conducted for contractor employees. Instead, the agencies relied on agency-wide testing of personnel security as a common control. However, agency-wide testing was not comprehensive enough to identify lapses that we found regarding background investigationssystems. Specifically, for one of the DOT systems we reviewed, for contractor personnel working on these department officials responsible for system testing had not evaluated whether the seven contractor employees working on the system had the required background investigation. When they did so in response to our audit, they found that three of them did not. Officials stated that they subsequently removed system access rights for the three contractor employees until their background investigations had been completed. For the department’s other selected system, DOT officials did not have evidence that 44 of 133 contractor employees had undergone a current background investigation.

For the two State systems we reviewed, department officials responsible for these systems stated that they did not believe that it was necessary for them to check whether contractor employees had undergone a background investigation. However, the system security plans for both State systems had documented the selection of background investigations as applicable security controls, therefore calling for them to be included in the scope of testing. By not testing that all contractor employees operating a system have had an appropriate background investigation completed, agency officials lack assurance that contractor employees can be trusted with access to government information and systems.

Furthermore, for 8 of the 12 systems that we reviewed, the agencies did not always ensure that system assessments accurately evaluated the extent to which contractor employees had completed contingency plan training as required. NIST guidance states that anyone with responsibilities for implementing the contingency plan should receive regular training on their role. However, DOE, DOT, EPA, OPM and State officials were unable to demonstrate that contractor employees had received the necessary training despite assessment results that stated they had. Additionally, DOT officials were unable to identify whether several staff members listed in the contingency plan of one system were federal employees or contractor personnel. Overseeing that key contractor staff had taken or completed the contingency plan training would provide increased assurance that contractor employees are familiar with their roles and responsibilities under the contingency plan.

Recommend remediation actions. All 12 of the system assessments that we reviewed produced a report showing recommendations from the assessor. NIST states that, since results of the security control assessment ultimately influence the content of the system security plan and the plan of action and milestones, agency officials should review the security assessment report to determine the appropriate steps required to correct weaknesses and deficiencies identified during the assessment. Furthermore, assessors’ recommendations in the security assessment report are an important input into agency officials’ risk-based decisions on addressing weaknesses. All 12 of the system assessments that we reviewed included recommendations to address weaknesses.

Review the assessment results. Three of the six agencies (DHS, EPA, and OPM) adequately reviewed assessment results, ensuring that all of the controls selected for the systems and the evaluation methods used for the controls were included. However, three of the six agencies (DOT, DOE, and State) did not adequately review the assessment results. For one system at DOT, DOE, and State, documentation provided by agency officials showed that a thorough review had not occurred by the authorizing official. NIST states that the systems authorizing official or designated representative is to assess the current security state of the system or the common controls inherited by the system. For the system at DOT, the test evidence for the media protection and physical security controls (25 total controls) that was documented, reviewed, and accepted was from a different DOT system. DOT officials confirmed that these controls had not been sufficiently tested and that they would test them as part of their next system assessment. At DOE, officials were able to provide the executive summary of the test results but could not show that the full test results had been reviewed. Agency officials stated that the computer housing the information became corrupted and the detailed test results could not be provided. In addition, at State, a system security control assessment did not document that 69 of the systems’ controls were tested, and the assessment showed that the results were reviewed and accepted. State officials were unable to provide a reason for this lapse. Without properly reviewing the assessment results, agency officials may lack assurance that all of the controls selected for a system are properly tested.

Develop a plan of action and milestones for remediation of weaknesses. Three of the six agencies (OPM, DHS, and DOE) for both systems we reviewed maintained POA&M that included all of the NIST elements, such as estimated completion dates, resource allocation and issue identification. For example, for one system we reviewed at OPM, the POA&M is maintained by agency officials using a software application that includes the elements required by NIST. However, three of the six agencies (DOT, State, and EPA) did not always complete or update POA&Ms for their contractor-operated systems. Specifically, the POA&Ms for one of the two systems we reviewed at State and DOT were missing information such as estimated completion dates and resources that were assigned to resolution. Additionally, State did not include all of the weaknesses identified in the assessment report within the POA&M for the second system we reviewed. State officials stated that those weaknesses should have been captured in the POA&M. EPA could not provide an updated POA&M for one of the two systems we reviewed. Without complete or up-to-date POA&Ms, agencies increase the risk that identified weaknesses will not be resolved in a timely fashion.

Selected Agencies Have Not Developed Procedures for Overseeing the Privacy and Security of Federal Information on Contractor- Operated Systems

The responsibility for adequately mitigating risks arising from the use of contractor-operated systems remains with the agency. OMB’s annual FISMA reporting instructions require agencies to develop policies for information security oversight of contractors and the FAR, in its procedures for acquisition planning, requires agencies to ensure that information technology acquisitions comply with FISMA, OMB’s implementing policies, and NIST guidance and standards. Further, NIST SP 800-53 states that agencies should develop, document and implement a process that provides oversight to ensure that agency testing of security and privacy controls is planned and conducted consistent with organizational priorities.

A contributing reason for shortfalls identified in agency oversight of contractors was that agencies had not documented procedures to direct officials in performing such oversight activities effectively. For example, system officials for one system at DOT that accepted assessment results for 25 controls from the wrong system; the department did not have procedures in place to direct officials on how to effectively review such test results.

According to the Office of the CIO officials we interviewed from each of the six selected agencies, all information security and privacy policies and procedures of each agency apply to their federal employees and systems as well as to contractors, contractor employees, and contractor-operated systems, and the system assessment process is intended to provide assurance that these policies and procedures are being implemented. However, as described in the previous section, we found inconsistencies in the oversight of contractor-operated systems at five of the six agencies; none of the agencies had procedures in place to direct officials in how to conduct such oversight. Such inconsistencies may have been mitigated if procedures had been created, documented and implemented. For example, agency officials reviewing system assessment results could refer to a procedure outlining the necessary actions for an effective review of an assessment conducted by contractors. As a result, agency officials have less assurance that oversight activities are being performed consistently and effectively over all of their contractor-operated systems and weaknesses may go undetected and unresolved, such as having contractor employees operate a system without undergoing a background investigation.

Government-wide Guidance for Contractor-Operated Systems Assists Agencies, but OMB Guidance Needs Clarification

In fulfilling its responsibilities to develop guidance and oversee the implementation of FISMA, OMB has issued guidance for agencies to ensure that contractors and contractor employees meet agency information security and privacy requirements. Specifically, OMB issues annual FISMA reporting instructions to guide agencies as they report on their security requirements. The instructions state that agencies are responsible for ensuring that systems operated by contractors meet FISMA information security requirements. The OMB instructions also state that systems operated by contractors are to be reported as part of the agency’s system inventory, tested on an annual basis, and reviewed appropriately. OMB collects the information from agencies on their implementation of FISMA, and then provides a summary of the data in an annual report to Congress.

Further, OMB has developed guidance over several years to assist agencies in assessing their contractors’ performance. The guidance ranges from providing agencies with overarching requirements for managing contractors to requiring agency officials with acquisition and procurement responsibilities to take specific actions. Examples of OMB guidance for agencies that address contractor management are shown in table 5.

OMB has also tasked DHS with certain responsibilities assisting government-wide efforts to provide adequate, risk based, and cost- effective cybersecurity. OMB and DHS have met with agency CIOs, chief information security officers, and other agency officials to discuss and assist in developing focused strategies for improving their agency’s cybersecurity posture. OMB officials from the Office of E-Government and Information Technology stated that agency contractor oversight for contractor-operated systems is discussed as needed at these meetings and that assisting agencies in implementing OMB guidance and instructions provides greater protections for all of an agency’s systems, including contractor-operated systems. OMB officials from the same office stated that these meetings allow them to conduct outreach and education to assist agencies in understanding their guidance as necessary.

OMB Guidance is Not Clear on When Systems Should Be Identified and Reported as Contractor- Operated

OMB guidance to agencies for categorizing and reporting contractor- operated systems does not clearly define what a contractor-operated system is and consequently, agencies are interpreting the guidance differently. FISMA assigns OMB responsibilities to develop and oversee the implementation of policies, principles, standards, and guidelines on information security in federal agencies. Guidance provided as part of OMB’s annual FISMA reporting instructions identifies several types of contractor relationships an agency may have in using a contractor for a system. However, it does not specify which agency systems that have contractor relationships should be categorized as contractor-operated. We and the inspectors general have found that not all agencies are interpreting this guidance in the same manner. Specifically, two of the six agencies we reviewed did not report all of their systems that are operated by contractors on their behalf as “contractor-operated” in their FISMA submissions. For example, CIO officials from the State Department stated that the number of contractor-operated systems the department reported as part of its 2012 FISMA submission did not include all systems that are operated by contractors. Rather, officials stated that the department only reported those systems that are both owned and operated by contractors by this label and identifies systems that are government-owned as “agency-operated” even when contractors operate the system on behalf of the department. Conversely, DHS officials stated that it reports systems as “contractor operated” only when they are government-owned but operated by contractors. DHS systems that are both owned and operated by contractors are designated by a third category known as an “external information system.” Those systems are not included in either the list of department’s agency-operated systems or contractor-operated systems.

Additionally, in their fiscal year 2012 annual FISMA reports, inspectors general from 9 of the 24 major agencies found data reliability issues with their agencies’ categorization of contractor-operated systems.example, DOT’s Inspector General reported that 24 of the Department’s 60 information systems were owned and operated by a contractor, but only 4 were categorized as being contractor-operated by the department.

OMB officials from the Office of E-Government and Information Technology stated that they believe the current guidance is sufficient to assist agencies in categorizing and reporting contractor-operated systems. OMB officials stated that, while they would not be able to identify all of the types of relationships that agencies have with contractors, agencies can refer to the guidance contained within the FISMA reporting instructions and its outline of five different categories of relationships that agencies may have with contractors operating systems or processing information on the agencies’ behalf.

Nevertheless, the inconsistent implementation of OMB’s reporting guidance by agencies in reporting the number of contractor-operated systems demonstrates that existing outreach and education efforts during face-to-face meetings with agency information security officials are not always resulting in accurate reporting of agencies’ reliance on contractors to operate systems and process government information on their behalf. Consequently, agencies are not reporting all of their contractor-operated systems in their FISMA submissions, the information is not complete enough to provide OMB with an accurate representation of the number of contractor-operated systems within the government, and OMB’s report to Congress on the implementation of FISMA is not complete. Without complete information about contractor-operated systems, OMB and DHS may limit their ability to assist agencies in improving their cybersecurity postures and Congress will not have complete information on the implementation of FISMA.

NIST and GSA Provide Guidance to Agencies for Addressing Security and Privacy Requirements for Contractor-Operated Systems

FISMA requires NIST to develop security standards and guidelines for agencies (other than national security systems), including when information and information systems are used or operated by a federal contractor on behalf of an agency. OMB Circular A-130 states that GSA should provide agencies with security guidance when acquiring information technology products or services.

To meet its FISMA requirements, NIST has issued guidance for agencies to follow in overseeing contractors as they operate, use, and access government information and information systems. It has produced numerous information security standards and guidelines and has updated existing information security publications to assist agencies in developing and implementing an information security program that manages risks, including those risks incurred through the use of contractors. For example, in April 2013, NIST released its fourth update of a key federal government computer security control guide, Special Publication 800-53: Security and Privacy Controls for Federal Information Systems and Organizations, which contains an external service providers section that has requirements for agencies to ensure that contractors meet the same requirements that agencies adhere to and recommends that agencies incorporate oversight controls such as establishing personnel security requirements, requiring third-party providers to notify the agency of personnel transfers, and monitoring provider compliance. Further, the guide includes an appendix on identifying and implementing controls for protecting privacy within an organization, including contractors.

Further, NIST officials stated that the risks incurred from utilizing contractors should be addressed by incorporating the risk management framework as part of the terms and conditions of the contract and that agencies can specify the security controls for which the contractor must implement and require appropriate evidence to demonstrate that they effectively implemented the specified controls. The risk management framework, specified in NIST Special Publication 800-37, provides a process that integrates information security and risk management activities into the system development life cycle.

GSA, in meeting its responsibilities under OMB Circular A-130 issued guidance, templates, and established pre-negotiated contracts for agencies using contractors to maintain agency information and systems.

GSA has also published an acquisition manual to assist agencies when they choose to create their own contracts.

Additionally, GSA has negotiated contracts for products and services to assist agencies transitioning to cloud computing services. Cloud computing services are being managed through FedRAMP, a government-wide program to provide joint authorization and continuous security monitoring services for all federal agencies. GSA creates standardized FedRAMP templates for contract language and security assessments, among other things, and sample service level agreements for use in cloud service acquisitions.

Conclusions

The six agencies reviewed made efforts to assess the implementation of security and privacy controls for selected contractor-operated systems. The agencies generally had established security and privacy requirements for contractors to follow and prepared for assessments to determine the effectiveness of contractor implementation of controls. However, oversight of the execution and review of assessments of contractor-operated systems was not consistent at five of the six agencies we reviewed. Specifically, agencies did not always prepare, execute, and review assessments of their contractor-operated systems. A contributing reason for these shortfalls is that agencies had not documented procedures for officials to follow in order to perform such oversight of contractors effectively. Until these agencies develop, document and implement specific procedures for overseeing contractors, they will have reduced assurance that the contractors are adequately securing and protecting agency information, including of the extent to which contractors have undergone background investigations.

OMB, NIST, and GSA have provided agencies guidance to assist in implementing privacy and security controls for contractor-operated systems. In addition, OMB and DHS are taking actions to assist agencies in planning to improve their cybersecurity posture. However, the lack of clear instructions to agencies for reporting contractor-operated systems has contributed to incomplete information regarding the number of contractor-operated systems within the government. Without complete information, OMB and DHS assistance to agencies for improving their cybersecurity postures is limited and Congress will not have complete information on the implementation of FISMA.

Recommendations for Executive Action

To ensure that the privacy and security controls of contractor-operated systems are being properly overseen, we are making 15 recommendations to five selected agencies.

We recommend that the Secretary of Energy develop, document, and implement oversight procedures for ensuring that, for each contractor- operated system: a system test plan is developed, a system test is fully executed, and test results are reviewed by agency officials.

We recommend that the Secretary of State develop, document, and implement oversight procedures for ensuring that, for each contractor- operated system: an independent assessor is selected to assess the system, a system test is fully executed, test results are reviewed by agency officials, and plans of action and milestones with estimated completion dates and security and privacy requirements are communicated to contractors, resources assigned for resolution are maintained.

We recommend that the Secretary of Transportation develop, document, and implement oversight procedures for ensuring that, for each contractor-operated system: a system test is fully executed, test results are reviewed by agency officials, and plans of action and milestones with estimated completion dates and security and privacy requirements are communicated to contractors, resources assigned to resolution are maintained.

We recommend that the Administrator of the Environmental Protection Agency develop, document, and implement oversight procedures for ensuring that, for each contractor-operated system: a system test is fully executed and plans of action and milestones with estimated completion dates and resources assigned for resolution are maintained.

We recommend that the Director of the Office of Personnel Management develop, document, and implement oversight procedures for ensuring that a system test is fully executed for each contractor-operated system.

To be able to effectively assist agencies with their contractor oversight programs, we recommend that the Director of the Office of Management and Budget, in collaboration with the Secretary of Homeland Security develop and clarify reporting guidance to agencies for annually reporting the number of contractor-operated systems.

Agency Comments and Our Evaluation

We received comments on a draft of this report from five of the six agencies to which we made recommendations. We requested comments from the Office of Management and Budget, but none were provided. The Departments of Energy, State, and Transportation, the Environmental Protection Agency and the Office of Personnel Management, generally agreed with our recommendations. A summary of their comments and our responses, where appropriate, are provided below.

In written comments, the Chief Information Officer for DOE stated that the department is working to align with the recommendations. For the one system where the department could not produce the test plan or show evidence that the plan had been executed, the department has targeted that system for a new security test and evaluation. DOE’s full comments are provided in appendix II.

In written comments, the acting Comptroller of the Department of State stated that the department agrees with our recommendations and is planning to develop, document, and implement oversight procedures for each contractor-operated, contractor-owned system. Additionally, he stated that department entities will seek to ensure the privacy and security controls of all contractor-operated systems. State’s comments are provided in appendix III.

The Deputy Director of Audit Relations from DOT stated via e-mail that the department agrees to consider our recommendations. We continue to believe that the department needs to develop, document, and implement oversight procedures for each contractor-operated system. system had not been updated by EPA since 2011. As a result of this information, we have modified the report and recommendation as appropriate. EPA’s comments are provided in appendix IV.

In written comments, the OPM Chief Information Officer concurred with our recommendation and stated that OPM will review its policies and procedures to further enhance OPM’s oversight of contractor- operated systems. OPM’s comments are provided in appendix V.

In addition, the three agencies covered by our review that did not receive recommendations also reviewed our draft. In written comments DHS’s Director of the Departmental GAO-OIG Liaison Office stated that although the Department did not receive a recommendation in this report, it will collaborate with OMB to update the FISMA guidance in support of our recommendation to OMB. DHS’s comments are provided in appendix VI. The other two agencies—GSA and NIST—responded via e-mail that they had no comment on the report through a representative of GSA’s GAO/IG Audit Response Division and a representative of NIST’s Management and Organization Division. We also received technical comments from the Department of State, which we addressed as appropriate.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Administrators of the Environmental Protection Agency and the General Services Administration, the Directors of the Office of Management and Budget and the Office of Personnel Management, the Secretaries of Energy, Homeland Security, State, and Transportation, and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov.

If you have any questions regarding this report, please contact me at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix VII.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to assess the extent to which (1) selected agencies oversee the security and privacy controls for systems that are operated by contractors on their behalf and (2) executive branch agencies with government wide guidance and oversight responsibilities have taken steps to assist agencies in ensuring implementation of information security and privacy controls by contractors.

For our first objective, we selected a non-generalizable sample of six Chief Financial Officers Act agencies. The six agencies selected were the Departments of Energy, Homeland Security, State, and Transportation; the Environmental Protection Agency; and the Office of Personnel Management. We selected these 6 agencies based on the number of contractor operated systems reported by the 24 Chief Financial Officer Act agencies from fiscal year 2011 Federal Information Security Management Act (FISMA) data. Specifically, we identified the eight agencies with the largest reported number of contractor-operated systems as high, the next eight agencies as medium, and the last eight agencies as low. We then selected the top two from the high, medium, and low groupings in order to review agencies that had a reported range in the number of contractor operated systems.

To gain insight into the six agencies’ practices for protecting the security and privacy of information and systems, we interviewed officials and reviewed documentation regarding their policies and procedures for overseeing contractor privacy and security practices, including reviewing each agency’s policies and procedures for identifying risks and vulnerabilities, providing security awareness training to personnel with significant information security responsibilities, developing plans of action and milestones, developing incident response plans, and testing of system security controls. We conducted interviews with officials from each agency’s Office of the Chief Information Officer, Privacy Office, procurement office, as well as system owners to understand how they oversee the implementation of the Federal Acquisition Regulation (FAR), FISMA, and Privacy Act requirements, relevant OMB policies, National Institute of Standards and Technology (NIST) guidance, and agency-wide and system-level policies and procedures.

To understand how well agencies’ were overseeing the implementation of agency requirements by contractors, we reviewed oversight efforts by agencies at the system level. We selected two systems at each agency using a non-generalizable random sample from a list of agency provided contractor-operated systems that were identified as having personally identifiable information and as either government-owned and contractor- operated and contractor-owned and contractor-operated. We examined whether the agencies for each selected system implemented oversight over key elements of federal requirements and guidance such as the FAR; FISMA; the Privacy Act, and NIST and Office of Management and Budget (OMB) guidance. The key elements were communicating requirements to contractors, selecting and documenting security controls, selecting an independent assessor, developing a test plan, executing the test plan, recommending remediation actions, reviewing results, and developing a plan of action and milestones. We also assessed whether agency officials at selected information systems implemented policies and procedures set forth by the agency, including contractor oversight activities performed by the responsible agency official.

For our second objective, we reviewed requirements and guidance provided by OMB, NIST, and the General Services Administration (GSA) to agencies used to assist them in conducting contractor oversight. We interviewed DHS, GSA, OMB, and NIST officials regarding the policies and procedures for overseeing contactor privacy and security, and the activities taken to provide assistance to agencies regarding oversight of contractor-operated systems. We analyzed agency responses to OMB and DHS guidance regarding contractor-operated systems. We also reviewed inspectors general FISMA reports to assess agencies progress in meeting FISMA reporting requirements related to contractor security, including the reliability of the reporting of contractor-operated systems by agencies. We also interviewed officials of inspectors’ general of the agencies we reviewed for the first objective to discuss how the agency’s are reporting their inventory of systems.

We conducted this performance audit from February 2013 to July 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Energy

Appendix III: Comments from the Department of State

Appendix IV: Comments from the Environmental Protection Agency

Appendix V: Comments from the Office of Personnel Management

Appendix VI: Comments from the Department of Homeland Security

Appendix VII: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the individual named above, the following staff also made key contributions to the report: Nicholas Marinos (assistant director), Melina Asencio, Sher’rie Bacon, Kathleen Feild, Nancy Glover, Wilfred Holloway, Thomas Johnson, David Plocher, and Jeffrey Woodward.