Office of Congressional Workplace Rights: Weaknesses in Cybersecurity Management and Oversight Need to Be Addressed
Released: 2020-02-11T00:00:00

Letter

Background

Enacted on January 23, 1995, the CAA, as amended, applies 13 federal civil rights, workplace, and labor laws to legislative branch employees who were previously exempted from such coverage. Table 1 lists the 13 laws included under the CAA.

The CAA contained a series of specific requirements for the Office of Compliance to meet as it carried out its responsibility to administer and enforce the act. Toward this end, the Office of Compliance took a number of actions, such as administering a dispute resolution process; conducting investigations and inspections to ensure compliance with safety, health, and disability access standards; investigating and managing matters concerning labor management relations, and educating both employees and employing offices about their rights and responsibilities under the CAA.

The Reform Act expanded the office’s duties and responsibilities, as well as the number of employees covered by the CAA. These new duties and responsibilities include, among other things: changing the name of the office to OCWR; substantially modifying the administrative dispute resolution process under the CAA, including creating additional procedures for preliminary hearing officer review of claims; appointing one or more advisers to provide confidential information to legislative branch employees about their rights under the CAA; extending CAA protections to unpaid staff, including interns, detailees, and fellows, as well as previously unprotected legislative branch employees; conducting a workplace climate survey; significantly expanding OCWR reporting obligations; creating a program to permanently retain records of investigations, mediations, hearings, and other proceedings; and establishing an electronic system to receive and keep track of claims.

The act mandated that OCWR institute some of these requirements, such as changing the name of the office, immediately. Other requirements, such as establishing an electronic system to receive and keep track of claims, were to be met no later than 180 days after the implementation of the act, or by June 19, 2019.

To implement its statutory requirements, OCWR currently has 28 full-time equivalent positions, which includes five part-time members of OCWR’s Board of Directors (counted as one full-time equivalent) appointed by congressional leadership. This represents an increase of five full-time equivalents since April 2018.

OCWR Relies on External Entities to Provide IT Services and Systems, Including the Upgrade to Its Claims Management System

OCWR relies extensively on IT services and systems provided by external parties to support its mission-related operations and protect claims data. For example, the Library provides network and end-user computing services for OCWR, including email; network services such as Internet access and file sharing; and end-user services and support, such as desktop support and software management.

OCWR also relied on an external contractor to develop and maintain its legacy claims management system, known as the Case Management System (CMS). Since 2014, the office used CMS to manage claims submitted by covered legislative branch employees using one of four ways: in person at OCWR’s office; or by mail, email, or fax. After a claim was received, an OCWR employee would manually enter the claim information into CMS and update the information as it progressed through the dispute resolution process.

In response to the Reform Act enacted in December 2018, OCWR initiated the SOCRATES project to meet the requirement of implementing an electronic system for claims. SOCRATES is intended to enable covered legislative branch employees to file a claim via a web-based form, and an OCWR employee to electronically manage the workflow of claims as they progress through the dispute resolution process. Specifically, the system is expected to maintain and track claim deadlines, generate correspondence, as well as update and store claim information.

OCWR relied on both the Library and an external contractor to upgrade CMS to SOCRATES. As part of its SOCRATES implementation efforts, OCWR first moved the CMS application and claim data from its office to the Library, which began hosting the system in April 2019. Between April 2019 and June 2019, OCWR’s external contractor continued work to develop and implement new and updated components for CMS to facilitate the electronic filing and management of claims. In addition, the external contractor worked to develop and implement the web-based form to electronically capture claims. According to OCWR, SOCRATES is comprised of three components that are hosted by the Library:

SOCRATES web-based form: This form is intended to be used by covered legislative branch employees to submit a claim alleging a violation of civil rights, workplace, or labor laws during their employment.

Secure information sharing platform: This platform is intended to be a web-based, secure workflow file collaboration application. The platform allows for the sharing of claim related information between OCWR, the covered employee, the employee’s office, and any other relevant parties (e.g., employee representatives).

SOCRATES internal CMS console: Based on updated functionality from OCWR’s CMS, this console is intended to provide secure, detailed workflow management of each claim that is submitted. Specifically, the console introduces new workflows based on the Reform Act’s updated requirements for a claim and allows OCWR employees to internally manage a claim.

Figure 1 shows the updated claim filing process using SOCRATES.

According to OCWR, testing of SOCRATES the week prior to its June 19, 2019, due date revealed numerous problems with the system. For example, if a user did not submit his or her claim within a certain amount of time, the system refreshed the webpage without saving the user’s data, forcing the user to restart the claim. As a result, OCWR delayed the deployment 7 days to allow time to resolve this issue and others. On June 26, 2019, OCWR deployed SOCRATES and began accepting claims via the web-based form.

In addition to SOCRATES, OCWR relies on the external contractor to provide hosting and application support for FMA. FMA is used by OCWR to document reported violations of the Occupational Safety and Health Act. The CAA requires OCWR to conduct biennial inspections of the legislative branch to ascertain compliance with the act and to report its findings to Congress. The office also reports its findings to the legislative branch agency that is reportedly in violation of the act in a Hazard Summary Report. The agency is responsible for responding, and providing verification of the abatement of violations and hazards documented in the findings, to OCWR.

Federal Information and Systems Are Increasingly Targeted by Cybersecurity Threats

IT systems supporting federal agencies are inherently at risk. These systems are highly complex and dynamic, technologically diverse, and often geographically dispersed. This complexity increases the difficulty in identifying, managing, and protecting the numerous operating systems, applications, and devices comprising the systems and networks. Compounding the risk, federal systems and networks are also often interconnected with other internal and external systems and networks, including the internet. This increases the number of avenues of attack.

Information and systems are subject to serious threats that can have adverse impacts on organizational operations and assets, individuals, other organizations, and the nation. These threats can include purposeful attacks, environmental disruptions, and human/machine errors, and may result in harm to the national and economic security interests of the United States.

In recognition of the growing threat, we have designated information security as a government-wide high-risk area since 1997. In 2003, we expanded the information security high-risk area to include the protection of critical cyber infrastructure. We further expanded the information security high-risk area in 2015 to include protecting the privacy of personally identifiable information.

Cybersecurity incidents continue to impact federal agencies, including those entities in the federal executive and legislative branch. For example, in fiscal year 2017, federal executive branch civilian agencies reported 35,277 incidents to the U.S. Computer Emergency Readiness Team. These incidents included web-based attacks, phishing, and the loss or theft of computing equipment. These incidents and others like them can pose a serious challenge to economic and national security and personal privacy. The following examples highlight the impact of incidents from legislative and executive branch entities: In January 2019, the Department of Justice announced that it had indicted two Ukrainian nationals for their roles in a large-scale, international conspiracy to hack into the Securities and Exchange Commission’s computer systems and profit by trading on critical information they stole. The indictment alleges that the two hacked into the commission’s Electronic Data Gathering, Analysis, and Retrieval system and stole thousands of files, including annual and quarterly earnings reports containing confidential, nonpublic, financial information, which publicly traded companies are required to disclose to the commission.

In July 2016, the Library announced that it had experienced a significant distributed denial-of-service attack that affected multiple internal and external Library systems and services. Specifically, the attack successfully disrupted services to multiple Library systems and services including email, databases, and public web domains, such as Congress.gov. According to the Library, the attack was sophisticated in both the size of the attack and methods that the attack employed.

In June 2015, the Office of Personnel Management reported that an intrusion into its systems had affected the personnel records of about 4.2 million current and former federal employees. Then, in July 2015, the agency reported that a separate, but related, incident had compromised its systems and the files related to background investigations for 21.5 million individuals. In total, the Office of Personnel Management estimated that 22.1 million individuals had some form of personally identifiable information stolen, with 3.6 million being a victim of both breaches.

Key Cybersecurity Management Activities Relevant to OCWR Have Been Established in Law and Guidance

Recognizing the importance of information security and privacy, Congress enacted the Federal Information Security Modernization Act of 2014 (FISMA), which requires federal agencies in the executive branch to develop, document, and implement an information security program and to evaluate the program for effectiveness. The act retains many of the requirements for federal agencies’ information security programs previously set by the Federal Information Security Management Act of 2002.

As legislative branch entities, OCWR and the Library are not subject to FISMA. However, OCWR’s Executive Director and the Library’s Chief Information Officer have chosen to follow aspects of the law’s requirements. For example, an interagency agreement between OCWR and the Library describes plans to protect OCWR’s CMS application and claim data using NIST guidance that is intended to satisfy FISMA requirements and relates to managing risks to the information system.

The 2002 act also assigns certain responsibilities to NIST, which is tasked with developing standards and guidelines for systems other than national security systems. These standards and guidelines must include, at a minimum, (1) standards to be used by all agencies to categorize all of their information and information systems based on the objectives of providing appropriate levels of information security, according to a range of risk levels; (2) guidelines recommending the types of information and information systems to be included in each category; and (3) minimum information security requirements for information and information system in each category.

Accordingly, NIST developed a risk management framework of standards and guidelines for agencies to follow in developing information security programs. The framework addresses broad information security and risk management activities to be followed in developing information systems, including categorizing the system’s impact level; selecting, implementing, and assessing security controls; authorizing the system to operate (based on progress in remediating control weaknesses and an assessment of residual risk); and monitoring the efficacy of controls on an ongoing basis.

GAO Has Previously Reported on OCWR Project Management Challenges and Information Security Weaknesses within the Library’s IT Environment

In December 2019, we reported that OCWR faced management challenges in implementing its new requirements under the Reform Act, such as establishing a program to permanently retain records of investigations, mediations, hearings, and other proceedings. Specifically, we determined that OCWR did not always use project schedules to manage the implementation of the requirements of the Reform Act. For example, we noted that the office used a project schedule for developing the workplace climate survey, but did not use a project schedule to manage the SOCRATES project. We also determined that OCWR did not address risks associated with its records retention program. For example, we noted that the office had not yet developed policies and procedures to address the risks associated with permanently retaining sensitive records, such as ensuring they remain confidential when stored in multiple locations.

Our report also identified weaknesses in OCWR’s IT planning, including that the office did not develop long-term strategies for recruiting and retaining staff with critical skills and competencies needed to achieve current and future agency goals. Accordingly, our report included six recommendations for the office related to incorporating key management practices into project planning and ensuring that it has the necessary skills and capacity to meet its mission. OCWR agreed with our recommendations and described plans to address them.

We have also previously reported on weaknesses with the Library’s information security program, as well as specific security controls that support OCWR’s systems and services.

In March 2015, we issued a report that identified weaknesses in the Library’s information security program. We made 10 recommendations to the Library aimed at better protecting IT systems and reducing the risk that the information they contain will be compromised. These recommendations included, among other things, developing contingency plans for all systems and conducting comprehensive and effective security testing for all systems within the time frames called for by Library policy. The Library generally agreed with our recommendations and described planned and ongoing actions to address them. As of January 2020, the Library fully implemented nine of the 10 recommendations and has taken steps to implement the remaining recommendation. We have work underway to determine whether the steps taken by the Library fully address the remaining recommendation.

In a related June 2015 limited official use only report, we made 74 detailed security recommendations aimed at addressing specific weaknesses in the Library’s security controls. The Library generally agreed with our security recommendations and described planned and ongoing actions to address them as well. As of January 2020, the Library had fully implemented 72 of 74 detailed security control recommendations from this report and had plans to implement the remaining two recommendations by February 2020.

OCWR Did Not Incorporate Key Cybersecurity Management Activities into Project Planning for Its Claim Management System Upgrade

Effectively managing a project entails, among other things, developing a project schedule, defining and managing requirements, and effectively managing project risks.

Project scheduling. The success of a program depends, in part, on having an integrated and reliable master schedule that defines, among other things, when work activities will occur, how long they will take, and how they relate to each other. A reliable schedule provides a road map for systematic execution of a program and a means by which to gauge progress, identify and address potential problems, and promote accountability. GAO’s Scheduling Assessment Guide lists 10 best practices associated with a high-quality and reliable schedule, including capturing and sequencing all activities, as well as establishing the duration of all activities.

Requirements management. Requirements establish what the system is to do, how well it is to do it, and how it is to interact with other systems. The Software Engineering Institute’s Capability Maturity Model Integration® for Acquisition (CMMI-ACQ) and Capability Maturity Model Integration® for Development (CMMI- DEV) note that requirements management processes are important for enabling programs to ensure that their set of approved requirements is managed to support planning and execution needs. This should include steps to obtain stakeholder’s review and commitment to the requirements and to manage changes to requirements as customer needs evolve.

Project risk management. The discipline of risk management is important to help ensure that projects are delivered on time, within budget, and with the promised functionality. According to leading practices for acquisition, the purpose of risk management is to identify potential issues that could endanger achievement of critical objectives before they occur. A continuous risk management approach effectively anticipates and mitigates risks that can have a critical impact on a project. Organizations that plan to acquire IT products and services for a project should also identify and assess risks associated with the acquisition process.

Incorporating cybersecurity management activities (such as the selection and implementation of security controls) into each of these project planning areas can help to reduce cybersecurity risks and better protect critical assets. For example, according to NIST’s risk management framework, integrating system security requirements into a project’s planning activities, such as scheduling, can help to ensure that resources are available when needed and that project milestones are met. In addition, the framework notes that defining the system security requirements early and integrating them with other system requirements can result in a system having fewer deficiencies, and therefore, fewer security vulnerabilities that can be exploited in the future. The framework also describes the importance of identifying security risks early in a system project and addressing such risks on an ongoing basis.

However, OCWR did not effectively manage the SOCRATES project because it did not establish a schedule, develop and manage requirements, and manage risks. Consequently, the office did not incorporate key cybersecurity management activities into each of these project planning areas. Specifically:

OCWR did not manage the SOCRATES project using an established, approved project schedule that identified when cybersecurity activities would be completed. As discussed earlier, we previously reported that OCWR did not establish a project schedule to manage the SOCRATES project. Although the office drafted a project schedule in January 2019, this schedule was not finalized and used during the project. According to OCWR’s Director of the IT Governance, Risk Management, and InfoSec Compliance Program, the schedule was not used due to, among other things, challenges encountered in managing the interdependencies of SOCRATES development with the implementation of other Reform Act requirements (e.g., modifying the administrative dispute resolution process).

Consequently, OCWR did not use a project schedule to manage key SOCRATES cybersecurity activities, including those to be completed by OCWR, the Library, and the contractor. To its credit, the Library provided an early project schedule with certain cybersecurity activities they performed related to CMS. For example, the Library’s project schedule documented initial activities the Library was to perform that related to procurement of equipment, installation of software, security testing, and vulnerability remediation in order to move CMS from OCWR to the Library. However, OCWR did not use a project schedule for the upgrade of CMS to SOCRATES that included the time frames for key cybersecurity management activities, such as selecting and documenting security controls, implementing controls, and assessing controls.

The lack of a project schedule likely hindered OCWR’s ability to respond to changes during the project and execute key cybersecurity management activities in a timely manner. For example, in May 2019, OCWR made a decision to use a locally hosted platform at the Library for its secure information sharing platform instead of a cloud-based solution. Without a project schedule, OCWR was unable to assess the impact of this late change on the time available for completing remaining cybersecurity management activities.

OCWR did not establish a requirements management process or develop a set of detailed system requirements, including cybersecurity requirements. OCWR did not establish a requirements management process that included steps to obtain stakeholders’ review and commitment to the requirements and to manage changes to the requirements. Instead, the office established a set of business flow diagrams, which identified how claim information would move within OCWR and SOCRATES. Further, OCWR did not establish a set of detailed system requirements, including the cybersecurity requirements (e.g., what cybersecurity controls were to be implemented).

OCWR did not document and manage risks to the SOCRATES project, including those related to cybersecurity. OCWR did not document and manage risks for the SOCRATES project. Specifically, the office did not document and manage risks related to cybersecurity and did not mitigate those risks that could have had a critical impact on the project. For example, OCWR was not able to ensure that the Library tested all moderate-level security controls for the SOCRATES web-based form and secure information sharing platform before the system was deployed. However, this was not documented or managed by OCWR as a risk.

In addition, as discussed later in this report, there were also risks associated with OCWR’s reliance on the Library and its external contractor that were implementing cybersecurity responsibilities on its behalf. For example, we identified shortfalls in the OCWR’s oversight of the planning and conducting of system security assessments.

However, no risks related to the office’s reliance on external parties were documented or managed throughout the project.

According to the Director of the IT Governance, Risk Management, and InfoSec Compliance Program, the office did not complete key project planning activities and documentation, in part, because of the compressed time frame associated with the project and the need to complete it by its mandated June 19, 2019, completion date. In aiming to meet this date, the OCWR official added that they held frequent discussions with the contractor and made changes “on the fly” to ensure that OCWR met the mandate. However, frequent discussions with the contractor does not negate the need to document and manage cybersecurity activities using leading project planning practices, including a project schedule, a requirements management process, and a risk management process.

OCWR’s project management weaknesses also occurred, in part, because the office lacked policies and procedures for IT project scheduling, requirements management, and risk management. Such policies and procedures are critical to have in place as OCWR plans future IT projects. For example, as of October 2019, the office was planning to move its other key system, FMA, to the Library in 2020. Until OCWR develops and implements policies and procedures for incorporating cybersecurity management activities into its IT project planning using a project schedule, a requirements management process, and a risk management process, it will continue to have a limited ability to effectively manage and monitor the completion of cybersecurity activities and will face increased cybersecurity risks.

OCWR Did Not Fully Implement Oversight Activities for Selected IT Systems Operated by External Parties on Its Behalf

The responsibility for adequately mitigating risks arising from the use of externally-operated systems remains with the agency itself. NIST Special Publications 800-53 and 800-53A guide agencies in selecting security and privacy controls for systems and assessing them to ensure that the selected controls are in place and functioning as expected. Additional NIST special publications on IT security services and risk management (Special Publications 800-35 and 800-37) identify several key activities important for assessing the security and privacy controls of information systems operated by external entities. The key activities and the steps included in NIST Special Publications 800-35 and 800-37 are shown in table 2.

For the two selected systems—SOCRATES and FMA—OCWR either partially implemented, or did not implement, system oversight activities. Table 3 details the extent to which OCWR implemented system oversight activities and is followed by a discussion of each activity.

Establish security and privacy requirements. OCWR partially implemented this oversight activity for both SOCRATES and FMA.

Communicate requirements to external entities. OCWR communicated certain security and privacy requirements to its external partners for these two systems. For example, the office’s agreements with the Library for SOCRATES stated that the system will be secured in accordance with NIST security guidelines, including Special Publication 800-37, and the Library’s security policy guidelines.

However, OCWR did not always include language in agreements in sufficient detail to ensure that requirements were communicated effectively. For example, the office did not always provide sufficient language to communicate privacy requirements related to the protection of personally identifiable information within its SOCRATES or FMA agreements. Further, OCWR’s agreements—related to FMA—expired during our review and contained references to retired Library guidelines that are no longer applicable or enforceable with regard to OCWR’s external contractor.

Select and document security and privacy controls. OCWR worked with the Library to select and document about 300 security and privacy controls and control enhancements for SOCRATES within a system security plan. Further, the office worked with the Library to support the selection of controls by documenting privacy risks and impacts to SOCRATES within a privacy impact assessment—as called for by NIST to assess the privacy risks associated with collecting and using personal information—that was referred to in the system security plan.

However, OCWR did not adequately oversee the selection and documentation of security and privacy controls in the system security plan that was used to plan and conduct initial control assessments for SOCRATES. In particular, the office did not always ensure that the system security plan for SOCRATES provided an appropriate description of controls to be implemented to meet the security and privacy requirements. For example, in certain instances, the system security plan described SOCRATES as a low-impact system when describing the security controls used to protect the system. These descriptions differed though from its actual classification as a moderate-impact system, as documented within an interagency agreement between OCWR and the Library. As another example, the system security plan for SOCRATES incorrectly described a security control related to the maintenance of SOCRATES as not applicable to moderate- impact systems. However, NIST’s classification of this control describes it as applicable to moderate-impact systems.

For the FMA system, OCWR relied on its external contractor to document a system security plan that generally described security requirements for the system. However, the plan did not document the privacy requirements or the specific security and privacy controls that were expected to be implemented for FMA as a low-impact system. For example, the plan did not specify an authority to report information to in the event of a security incident. Further, the plan did not include or refer to other necessary security and privacy documentation, such as a privacy impact assessment. As a result, OCWR did not adequately oversee the completion of this key step for its FMA system.

Plan assessment of security controls. OCWR partially implemented this oversight activity for SOCRATES and did not implement it for FMA.

Select an independent assessor. OCWR relied on the Library to select an assessor for SOCRATES who was independent. For example, for SOCRATES, the Library used an external contractor to initially assess the system and reported taking steps to verify that the assessor was independent from the Library. However, the office did not adequately oversee the completion of this key step for SOCRATES and did not ensure that the assessor used for the system was independent from the office. Specifically, OCWR allowed the Library to select the assessor for SOCRATES and did not take steps to verify the assessor’s independence. Further, for FMA, OCWR did not select an assessor to review the system.

Develop a test plan. Although OCWR relied on the Library to develop a test plan for SOCRATES, the test plan used to conduct initial control testing was not approved by the office and did not specify the procedures that were to be followed to test each control from the SOCRATES system security plan. For example, the SOCRATES test plan specified a high-level procedure for collecting relevant artifacts but did not specify what particular documentation would be collected or reviewed for each control identified in the system security plan. Regarding FMA, OCWR and its external contractor did not develop a test plan.

Conduct assessment. OCWR partially implemented this oversight activity, which includes executing the test plan, for SOCRATES and did not implement it for FMA. Specifically, OCWR worked with the Library to perform initial control testing for SOCRATES and document the results in an online tracking system; however, as previously mentioned, the office did not ensure that a test plan with detailed procedures to test each control was developed and approved prior to the initial testing of SOCRATES. As a result, the office did not adequately oversee the execution of the test plan by the Library to ensure that controls that were assessed as implemented were effectively operating as intended. For FMA, OCWR and its external contractor did not execute a test plan or document the results of any tests for the system.

Review assessment. OCWR partially implemented this oversight activity, which includes developing POA&Ms for remediation of weaknesses, for SOCRATES and did not implement it for FMA. Specifically, OCWR worked with the Library to develop POA&M data for SOCRATES that included many of the recommended NIST elements, such as estimated completion dates and issue identification. For example, following initial control testing in March 2019, OCWR and the Library worked to develop POA&M data for 62 security control weaknesses, including 24 high-risk and 38 moderate- risk weaknesses. As of November 2019, there were seven POA&Ms, including six categorized as high-risk and one as moderate-risk, that OCWR and the Library had not yet addressed.

However, as previously mentioned, the office did not ensure that a test plan that included detailed procedures to test each control was developed and approved prior to the initial testing of SOCRATES. Therefore, the office could not ensure that controls were tested appropriately to identify necessary remedial actions in POA&Ms. As a result, OCWR did not adequately oversee the completion of this step and ensure that key POA&Ms were appropriately documented. For FMA, without an executed test plan, OCWR and its external contractor could not complete or update POA&Ms for the system.

According to OCWR officials, including the office’s Deputy Executive Director, part of the reason for these shortfalls was that the office did not obtain expertise in security to aid in the completion of these oversight activities until September 2018 when the office hired a new IT Manager. In addition, OCWR officials, including the Deputy Executive Director, could not explain why the contractor did not produce key oversight related artifacts, such as those related to the security testing of controls, as agreed upon in contracts covering FMA during the performance period. However, a key contributing reason that we identified for the shortfalls in OCWR’s oversight of external partners was that OCWR had not documented procedures to direct the office in performing such oversight activities effectively.

The lack of documented oversight procedures and shortfalls in OCWR’s oversight of its external partners contributed to concerns with the deployment of SOCRATES. For example:

As previously discussed, OCWR did not ensure that all moderate- level security controls for the SOCRATES web-based form and secure information sharing platform were tested before the system was deployed in June 2019. For example, a control related to testing contingency plans for the SOCRATES web-based form was not assessed until August 2019, approximately 2 months after the system was deployed.

Although penetration testing of the CMS portion of SOCRATES was completed in May 2019, OCWR did not ensure that penetration testing of the SOCRATES web-based form and secure information sharing platform was conducted before deployment. Penetration testing for the SOCRATES web-based form and secure information sharing platform was subsequently completed in December 2019, approximately 6 months after the system was deployed.

Until OCWR develops and implements effective oversight procedures over its external partners, it may not be able to mitigate risks that could result in the loss of sensitive data or compromise of the office’s external systems.

We also assessed selected security controls in place for SOCRATES and FMA including, but not limited to, configuration management, patch management, and personnel security. We intend to issue a separate limited official use only report that discusses the results of this review.

OCWR Has Not Fully Established an Effective Approach for Managing Organization-Wide Cybersecurity Risk

NIST’s cybersecurity framework is intended to support federal agencies as they develop, implement, and continuously improve their cybersecurity risk management programs. In this regard, the framework identifies cybersecurity activities for achieving specific outcomes over the lifecycle of an organization’s management of cybersecurity risk.

According to NIST, the first stage of the cybersecurity risk management lifecycle—which the framework refers to as “identify”—is focused on foundational activities for effective risk management that provide agencies with the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities. Additional NIST guidance, including its risk management framework, provides information on implementing foundational activities and achieving desired outcomes that calls for, among other things, the following:

A risk executive in the form of an individual or group that provides agency-wide oversight of risk activities and facilitates collaboration among stakeholders and consistent application of the risk management strategy. This functional role helps to ensure that risk management is institutionalized into the day-to-day operations of organizations as a priority and integral part of carrying out missions.

A cybersecurity risk management strategy that articulates how an agency intends to assess, respond to, and monitor risk associated with the operation and use of the information systems it relies on to carry out the mission. The strategy should, among other things, make explicit an agency’s risk tolerance, accepted risk assessment methodologies, a process for consistently evaluating risk across the organization, risk response strategies, approaches for monitoring risk over time, and priorities for investing in risk management.

Risk-based policies and procedures that act as the primary mechanisms through which current security requirements are communicated to help reduce the agency’s risk of unauthorized access or disruption of services. If properly implemented, these policies and procedures may be able to effectively reduce the risk that could come from cybersecurity threats such as unauthorized access or disruption of services. For example, establishing policies and procedures that incorporate NIST’s risk management framework can help to ensure that a consistent approach is used to conduct a complete security assessment before a system is deployed and that a designated agency official certifies the system for operation based on progress in remediating control weaknesses and an assessment of residual risk.

To its credit, OCWR’s strategic plan for fiscal years 2019 through 2023 includes a goal of developing, among other things, cybersecurity risk policies and procedures. The strategic plan also describes the office’s plans to ensure compliance with applicable IT and cybersecurity standards.

Nevertheless, OCWR has not yet fully established an effective approach to organization-wide cybersecurity risk management that includes foundational elements. Specifically, although the office’s Director of the IT Governance, Risk Management, and InfoSec Compliance Program stated that he was serving as the risk executive, this role and its related responsibilities are not documented in OCWR’s policies. In addition, OCWR has not developed an organization-wide cybersecurity risk management strategy or determined a time frame for when the policies and procedures discussed in its strategic plan will be implemented.

According to the Director of the IT Governance, Risk Management, and InfoSec Compliance Program, the reason for these shortfalls in risk management was that the office’s top priority was completing work on the SOCRATES system, and then it planned to work on its cybersecurity policies and procedures. Additionally, the official stated that OCWR considers development of documentation to be a continual process, and that the office would like to develop and build procedures to lay a foundation for effective risk management.

However, until OCWR establishes the role and responsibilities of the risk executive function in policy, the office will lack an understanding of who is ultimately responsible for overseeing the cybersecurity risk activities of the organization and what those responsibilities include. Further, until OCWR establishes and implements a strategy for managing its cybersecurity risks using NIST’s framework, its ability to make operational decisions that adequately address security risks and prioritize IT security investments will be hindered. Finally, until OCWR establishes a time frame for developing and implementing risk-based policies and procedures, it will lack assurance that consistent steps are being taken to categorize systems; select, implement, and assess system security controls; and make risk-based decisions on authorizing systems to operate.

Conclusions

Although OCWR completed the upgrade of its legacy claims management system through the SOCRATES project, the office did not incorporate cybersecurity activities into the project during planning. As a result, OCWR was left without a complete understanding of potential schedule issues, the system’s planned security requirements, and cybersecurity- related risks to the success of the project. These shortcomings existed, at least in part, because of a lack of OCWR policies and procedures that required cybersecurity management activities be incorporated into project scheduling, requirements management, and risk management. Until OCWR develops and implements such policies and procedures, future IT projects—such as the office’s planned transition of its FMA system to the Library—may face unnecessary cybersecurity risks and may not be carried out in an efficient and effective manner.

OCWR made initial efforts to assess the implementation of security and privacy controls for the two selected externally-operated systems, but did not fully implement critical oversight activities. A contributing reason for these shortfalls is that OCWR had not documented procedures for the office to follow in order to perform such oversight of its external entities effectively. This ultimately contributed to OCWR not being able to first test important system security controls for ensuring the confidentiality, integrity, and availability of the system before it was deployed. Until OCWR establishes and implements specific procedures for overseeing external entities, it will have reduced assurance that external entities are adequately securing and protecting the office’s information. In addition, the office will face increased risks that system weaknesses may go undetected and unresolved, which could result in the loss of sensitive data or compromise of its systems.

Given the increasing number and sophistication of cyber threats facing federal agencies, it is critical that organizations such as OCWR are well positioned to make consistent, informed risk-based decisions in protecting their systems and information against these threats. To its credit, OCWR has recognized the need for an improved organization-wide approach to its cybersecurity policies and IT governance in its most recent strategic plan. However, important elements of an effective organization-wide cybersecurity approach have not been fully implemented, including establishing the roles and responsibilities for the risk executive function in policy, a cybersecurity risk management strategy, and policies and procedures for managing cybersecurity risks. Until OCWR fully addresses these organization-wide cybersecurity risk management practices, its ability to ensure effective oversight and management of IT will remain limited. Moreover, OCWR may be limited in its ability to strengthen its risk posture, including ensuring effective cybersecurity across its relationships with external entities that are critical to its ability to provide IT services and systems needed to meet its mission.

Recommendations

We are making five recommendations to the Office of Congressional Workplace Rights: The Executive Director should ensure the development and implementation of policies and procedures for incorporating key cybersecurity activities into IT project planning, including scheduling, requirements management, and risk management. (Recommendation 1)

The Executive Director should ensure the development and implementation of oversight procedures for each externally-operated system that include establishing security and privacy requirements, planning the assessment of security controls, conducting the assessment, and, reviewing the assessment. (Recommendation 2)

The Executive Director should ensure the establishment of roles and responsibilities for a risk executive function. (Recommendation 3)

The Executive Director should ensure the development and implementation of a cybersecurity risk management strategy. (Recommendation 4)

The Executive Director should ensure commitment to a time frame for developing and implementing policies and procedures for managing cybersecurity risk. (Recommendation 5)

Agency Comments, Third-Party Views, and Our Evaluation

We provided a draft of this report to OCWR, the Library, and the third- party contractor for review and comment. In response, we received written comments from OCWR, which are reproduced in appendix II. In its comments, the office did not state whether it agreed or disagreed with our recommendations, but described initial actions taken and planned to address them. Specifically, OCWR noted that it has initiated several actions, such as revising the office’s IT systems project planning to ensure the development and implementation of policies and procedures incorporating key cybersecurity activities. Further, OCWR stated that it intends to implement additional changes, such as developing and implementing oversight procedures for each externally-operated system. Going forward, OCWR stated that it intends to update us on its progress in implementing the recommendations.

We also received technical comments from the Library’s Deputy Chief Information Officer via email, which we incorporated as appropriate. In addition, the third-party contractor indicated via email that it had no concerns about, and worked with OCWR in responding to, the draft report.

We are sending copies of this report to the appropriate congressional committees, the Executive Director of the Office of Congressional Workplace Rights, the Librarian of Congress, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-9342 or marinosn@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to examine the extent to which the Office of Congressional Workplace Rights (OCWR) (1) incorporated key cybersecurity management activities into the project planning for its claims management system upgrade, (2) performed oversight of security controls and mitigated risks for selected systems operated by external parties on its behalf, and (3) established an effective organization-wide approach for managing cybersecurity risk.

To assess OCWR’s incorporation of key cybersecurity management activities into the project planning for its claim management system upgrade (known as the Secure Online Claims Reporting and Tracking E- filing System, or SOCRATES), we reviewed available OCWR project planning documentation related to establishing a project schedule, requirements management process, and risk management process. This documentation included, for example, a draft SOCRATES project schedule, contract information, and business flow diagrams. We then compared OCWR’s documentation to leading practices for project planning, including those identified by the Software Engineering Institute. Three key areas needed to effectively managing projects are developing a project schedule; managing project requirements; and managing project risks.

We also analyzed OCWR’s available project planning documentation to determine the extent that it incorporated key cybersecurity management activities, as identified by the National Institute of Standards and Technology (NIST) risk management framework. These key activities are: obtaining a system categorization, selecting and implementing security controls, assessing security controls, obtaining an authority to operate, and monitoring of security controls. Further, we conducted interviews with OCWR officials, including the General Counsel and the Director of the Information Technology (IT) Governance, Risk Management, and InfoSec Compliance Program, to assess the extent to which the office incorporated key cybersecurity management activities into its SOCRATES project planning.

To assess the extent to which OCWR performed oversight of security controls and mitigated risks for selected externally-operated systems, we chose two systems—SOCRATES and the Facility Management Assistant (FMA). We chose these two systems because they process and maintain OCWR’s most sensitive information, including claims related to alleged violations of employee rights and protections and reported occupational safety and health violations. We then collected and reviewed cybersecurity policies, procedures, and documentation (e.g., system security plans) from the office and its external partners that related to protecting the security and privacy of information and systems.

To assess the reliability of the SOCRATES system security plan and its security control testing data obtained from the Library’s online repository, we reviewed related documentation (e.g., security assessment results briefings), reviewed the data for obvious omissions (i.e., fields left blank), and performed electronic testing to identify outliers. We also interviewed Library officials to discuss the reliability of the data. Based on our assessment, we determined that the data were sufficiently reliable for the purpose of our reporting objectives.

We then examined whether OCWR and its external partners implemented—for each selected system—four oversight activities important for assessing the security and privacy controls of information systems operated by external entities, as specified in federal requirements and guidance, including NIST Special Publications 800-35, and 800-37. The four oversight activities we examined were: (1) establishing security and privacy requirements, (2) planning the assessment of security controls, (3) conducting the assessment, and (4) reviewing the assessment. We chose these activities because of their importance to providing effective oversight of systems operated by external entities.

Further, we assessed whether OCWR implemented policies and procedures set forth by the office, including contractor oversight activities performed by the responsible official. We also conducted interviews with officials from OCWR, including the General Counsel, Deputy Executive Director, and Director of the IT Governance, Risk Management, and InfoSec Compliance Program. In addition, we also interviewed key personnel from OCWR’s external partners, such as the Library’s Deputy Chief Information Officer and the President of the external contractor, to assess the extent of OCWR’s oversight activities for SOCRATES and FMA.

We assessed selected security controls in place for SOCRATES and FMA including, but not limited to, configuration management, patch management, and personnel security. We intend to issue a separate limited official use only report that discusses the results of this review.

To assess OCWR’s efforts to establish an effective organization-wide approach for cybersecurity risk management activities, we used NIST’s cybersecurity framework, which identifies foundational components of effective cybersecurity risk management. We also used additional guidance provided by NIST for implementing the foundational components and achieving desired outcomes. These components included the establishment of a risk executive function, cybersecurity risk management strategy, and risk-based security policies and procedures.

We then evaluated OCWR’s organization-wide cybersecurity risk management approach by, among other things, analyzing available policies and plans, management reports, and strategic planning documentation against the foundational cybersecurity risk management components identified in NIST guidance. Further, we conducted semistructured interviews with relevant OCWR officials with responsibilities for managing their efforts to establish an approach for managing cybersecurity risk, including the General Counsel and the Director of the IT Governance, Risk Management, and InfoSec Compliance Program.

We conducted this performance audit from January 2019 to February 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Office of Congressional Workplace Rights

Appendix III: GAO Contacts and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Jon Ticehurst (Assistant Director), Lisa Hardman (Analyst in Charge), Edward Alexander, Jr., Angela Bell, Christina Bixby, David Blanding, Hannah Brookhart, Kisa Bushyeager, Christopher Businsky, West Coile, Linda Erickson, Rebecca Eyler, Kaelin Kuhn, Sukhjoot Singh, Eugene Stevens, and Adam Vodraska made key contributions to this report. Giny Cheong, Edda Emmanuelli-Perez, Elizabeth Fan, Steven Lozano, Rebecca Woiwode, and Edith Yuh also provided valuable assistance.