Federal Information Security: Agencies Need to Correct Weaknesses and Fully Implement Security Programs
Released: 2015-09-29T00:00:00

Letter

Background

To help protect against threats to federal systems, FISMA 2002 set forth a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. This framework created a cycle of risk management activities necessary for an effective security program. It was also intended to provide a mechanism for improved oversight of federal agency information security programs. To ensure the implementation of this framework, FISMA 2002 assigned specific responsibilities to agencies, their inspectors general, OMB, and NIST.

FISMA 2002 required each agency in the executive branch to develop, document, and implement an information security program that includes the following components: periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; policies and procedures that (1) are based on risk assessments, (2) cost-effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements; subordinate plans for providing adequate information security for networks, facilities, and systems or a group of information systems, as appropriate; security awareness training to inform personnel of information security risks and of their responsibilities in complying with agency policies and procedures, as well as training personnel with significant security responsibilities for information security; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security incidents; and plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency.

In addition, each of the agencies in the executive branch were to report annually to OMB, certain congressional committees, and the Comptroller General on the adequacy and effectiveness of information security policies, procedures, and practices, and their compliance with the act. FISMA 2002 also required each agency inspector general, or other independent auditor, to annually evaluate and report on the information security program and practices of the agency.

OMB’s responsibilities included developing and overseeing the implementation of policies, principles, standards, and guidelines on information security in federal agencies except with regard to national security systems. FISMA 2002 also assigned responsibility to OMB for ensuring the operation of a federal information security incident center. The required functions of this center are performed by DHS’s United States Computer Emergency Readiness Team (US-CERT), which was established to aggregate and disseminate cybersecurity information to improve warning and response to incidents, increase coordination of response information, reduce vulnerabilities, and enhance prevention and protection. OMB is also responsible for reviewing, at least annually, and approving or disapproving agencies’ information security programs.

Since it began issuing guidance to agencies in 2003, OMB has instructed agency chief information officers and inspectors general to report on a variety of metrics in order to satisfy reporting requirements established by FISMA 2002. Over time, these metrics have evolved to include administration priorities and baseline metrics meant to allow for measurement of agency progress in implementing information security- related priorities and controls. OMB requires agencies and inspectors general to use an interactive data collection tool called CyberScope to respond to these metrics. The metrics are used by OMB to summarize agencies’ progress in meeting FISMA 2002 requirements and report this progress to Congress in an annual report, as required by FISMA 2002.

NIST’s responsibilities under FISMA 2002 included the development of security standards and guidelines for agencies that include standards for categorizing information and information systems according to ranges of impact-levels (See Federal Information Processing Standards 199 and 200), minimum security requirements for information and information systems in risk categories, guidelines for detection and handling of information security incidents, and guidelines for identifying an information system as a national security system.

During the 12 years FISMA 2002 was enacted into law and then largely replaced by FISMA 2014, executive branch oversight of agency information security has evolved. As part of its FISMA 2002 oversight responsibilities, OMB has issued annual instructions for agencies and inspectors general to meet FISMA 2002 reporting requirements. In July 2010, the Director of OMB and the White House Cybersecurity Coordinator issued a joint memorandum that gave DHS primary responsibility within the executive branch for the operational aspects of cybersecurity for federal information systems that fall within the scope of FISMA 2002. This memo stated that DHS would have these five responsibilities: overseeing implementation of and reporting on government cybersecurity policies and guidance; overseeing and assisting government efforts to provide adequate, risk-based, and cost-effective cybersecurity; overseeing agencies’ compliance with FISMA 2002; overseeing agencies’ cybersecurity operations and incident response; annually reviewing agencies’ cybersecurity programs.

The OMB memo further stated that, in carrying out these responsibilities, DHS was to be subject to general OMB oversight in accordance with the provisions of FISMA 2002. In addition, the Cybersecurity Coordinator would lead the interagency process for cybersecurity strategy and policy development.

In accordance with guidance contained in the memo, DHS, instead of OMB, issued guidance to agencies and inspectors general on metrics used for reporting agency performance of cybersecurity activities and privacy requirements, while OMB continued to provide more general reporting guidance. Specifically, DHS provided guidance to agencies for reporting on the implementation of security requirements in areas such as continuous monitoring, configuration management, incident response, security training, and contingency planning, among others. The guidance also instructs inspectors general on reporting the results of their annual evaluations and instructs senior agency officials for privacy on reporting their agencies’ implementation of privacy requirements.

As previously mentioned, DHS is also responsible for ensuring the operation of a federal information security incident center to improve warning and response to incidents, increase coordination of response information, reduce vulnerabilities, and enhance prevention and protection. Within DHS, the Federal Network Resilience division’s Cybersecurity Performance Management Branch is responsible for (1) developing and disseminating FISMA 2002 reporting metrics, (2) managing the CyberScope web-based application, and (3) collecting and reviewing federal agencies’ cybersecurity data submissions and monthly data feeds to CyberScope. In addition, the Cybersecurity Assurance Program Branch is responsible for conducting cybersecurity reviews and assessments at federal agencies to evaluate the effectiveness of agencies’ information security programs.

New FISMA Requirements Clarify Roles and Responsibilities

To further improve cybersecurity and clarify oversight responsibilities, Congress passed FISMA 2014. FISMA 2014 is intended to address the increasing sophistication of cybersecurity attacks, promote the use of automated security tools with the ability to continuously monitor and diagnose the security posture of federal agencies, and provide for improved oversight of federal agencies’ information security programs. Specifically, the act clarifies and assigns additional responsibilities to OMB, DHS, and federal agencies in the executive branch. These new responsibilities include:

Preserves OMB’s oversight responsibilities, but removes the requirement for OMB to annually review and approve agencies’ information security programs.

Requires OMB to include in its annual report to Congress a summary of major agency information security incidents, an assessment of agency compliance with NIST standards, and an assessment of agency compliance with breach notification requirements. For two years after enactment, OMB is to include in its annual report an assessment of agencies’ adoption of continuous diagnostic technologies and other advanced security tools.

Requires OMB to update data breach notification policies and guidelines periodically and require notice to congressional committees and affected individuals.

Expands exemptions from OMB oversight for certain national security- related systems.

States that OMB shall, in consultation with DHS, the Chief Information Officers Council, the Council of Inspectors General on Integrity and Efficiency, and other interested parties as appropriate, ensure the development of guidance for evaluating the effectiveness of an information security program and practices.

Establishes DHS responsibility, in consultation with OMB, to administer the implementation of agency information security policies and practices for information systems other than national security systems, the Department of Defense, and the Intelligence community’s “debilitating impact” systems.

Requires DHS to develop, issue, and oversee implementation of binding operational directives to agencies. Such directives include those for incident reporting, contents of annual agency reports, and other operational requirements.

Gives DHS responsibility to operate the federal information security incident center, deploy technology to continuously diagnose and mitigate threats, compile and analyze data, and develop and conduct targeted operational evaluations, including threat and vulnerability assessments of systems.

Requires agencies to comply with DHS operational directives in addition to OMB policies and procedures and NIST standards.

Requires agencies to ensure that senior officials carry out assigned responsibilities and that all personnel are held accountable for complying with the agency’s information security program.

Requires agencies to use automated tools in periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices.

Requires agencies to report major security incidents to Congress within 7 days. Agencies are also to include a description of major incidents in their annual report to Congress.

FISMA 2014 also requires that the annual independent evaluation include an assessment of the effectiveness of the information security policies, procedures, and practices of the agency. This replaces the previous FISMA 2002 requirement that the independent annual evaluation include an assessment of agency compliance with the requirements of the act and related policies, procedures, standards, and guidelines.

In addition, FISMA 2014 reiterates the previous requirement for federal agencies to develop, document, and implement an agency-wide information security program. Each agency and its Office of Inspector General are still required to report annually to OMB, selected congressional committees, and the Comptroller General on the adequacy of the agency’s information security policies, procedures, practices, and compliance with requirements.

Continued Weaknesses Place Federal Agencies’ Information and Information Systems at Risk

During fiscal years 2013 and 2014, federal agencies continued to experience weaknesses in protecting their information and information systems. These systems remain at risk as illustrated in part by the evolving array of cyber-based threats and the increasing numbers of incidents reported by federal agencies. (See app. II for additional information on cyber threats and exploits.) At the same time, weaknesses in their information security policies and practices hinder their efforts to protect against threats. Furthermore, our work and reviews by inspectors general highlight information security control deficiencies at agencies that expose information and information systems supporting federal operations and assets to elevated risk of unauthorized use, disclosure, modification, and disruption. Accordingly, we and agency inspectors general have made hundreds of recommendations to agencies to address these security control deficiencies.

Number of Incidents Reported by Federal Agencies Continues to Increase

The number of information security incidents affecting systems supporting the federal government has continued to increase. Since fiscal year 2006, the number rose from 5,503 to 67,168 in fiscal year 2014: an increase of 1,121 percent. Figure 1 illustrates the increasing number of security incidents at federal agencies from 2006 through 2014.

Similarly, the number of information security incidents involving PII reported by federal agencies has more than doubled in recent years, from 10,481 in 2009 to 27,624 in 2014.

Of the incidents occurring in 2014 (not including those reported as non- cyber incidents) scans/probes/attempted access was the most widely reported type of incident across the federal government. This type of incident can involve identifying a federal agency computer, open ports, protocols, service, or any combination of these for later exploit. As shown in figure 2, these incidents represented 19 percent of the various incidents reported to US-CERT in fiscal year 2014.

These incidents and others like them can pose a serious challenge to economic, national, and personal privacy and security. Recent examples highlight the impact of such incidents: In June 2015, OPM reported that an intrusion into its systems affected the personnel records of about 4.2 million current and former federal employees. The Director of OPM also stated that a separate but related incident affected background investigation files and compromised OPM systems related to background investigations for 21.5 million individuals.

In June 2015, the Commissioner of the Internal Revenue Service testified that unauthorized third parties had gained access to taxpayer information from its “Get Transcript” application. According to officials, criminals used taxpayer-specific data acquired from non-department sources to gain unauthorized access to information on approximately 100,000 tax accounts. These data included Social Security information, dates of birth, and street addresses. In an August 2015 update, the Internal Revenue Service reported this number to be about 114,000, and that an additional 220,000 accounts had been inappropriately accessed, which brings the total to about 330,000 accounts.

In April 2015, the Department of Veterans Affairs’ Office of Inspector General reported that two contractors had improperly accessed the agency’s network from foreign countries using personally owned equipment.

In February 2015, the Director of National Intelligence stated that unauthorized computer intrusions were detected in 2014 on the networks of the Office of Personnel Management and two of its contractors. The two contractors were involved in processing sensitive PII related to national security clearances for federal employees.

In September 2014, a cyber intrusion into the United States Postal Service’s information systems may have compromised PII for more than 800,000 of its employees.

In October 2013, a wide-scale cybersecurity breach involving a U.S. Food and Drug Administration system occurred that exposed the PII of 14,000 user accounts.

Cybersecurity Deficiencies Continue to Place Systems at Risk

Our work at federal agencies continues to highlight information security deficiencies in both financial and nonfinancial systems. We have made hundreds of recommendations to agencies to address these security control deficiencies, but many have not yet been fully implemented. The following examples describe the risks we found at federal agencies, our recommendations, and the agencies’ responses to our recommended actions.

In March 2015, we reported that the Internal Revenue Service had not installed appropriate security updates on all of its databases and servers, and had not sufficiently monitored control activities that support its financial reporting and protect taxpayer data. Also, the agency had not effectively maintained secure settings or separation of duties by allowing a developer unnecessary access to a key application. In addition to 51 recommendations made in prior years that remain unimplemented, we made 19 additional recommendations to help the agency more effectively implement elements of its information security program and address newly identified control weaknesses. The Internal Revenue Service agreed to develop corrective action plans, as appropriate, to address these recommendations.

In January 2015, we reported that the Federal Aviation Administration had significant security control weaknesses in the five air traffic control systems we reviewed. These systems perform functions such as determining and sharing precise aircraft location, streaming flight information to cockpits of aircraft, providing telecommunications infrastructure for NextGen, and are necessary for ensuring the safe and uninterrupted operation of the national airspace system. We identified numerous weaknesses in controls intended to prevent, limit, and detect unauthorized access to computer resources, such as controls for protecting system boundaries, identifying and authenticating users, authorizing users to access systems, encrypting sensitive data, and auditing and monitoring activity on its systems. The agency also had not fully implemented an agency-wide information security program, in part due to not having fully established an integrated, organization-wide approach to managing information security risk. We made 168 recommendations to the agency to mitigate control deficiencies and 17 recommendations to fully implement its information security program and establish an integrated approach to managing information security risk. The Federal Aviation Administration concurred with our recommendations, described actions that it was taking to improve its information security, and indicated that it would address the recommendations.

In November 2014, we reported that the Department of Veterans Affairs had not taken effective actions to contain and eradicate a significant incident detected in 2012 involving a network intrusion. Further, the department’s actions to address vulnerabilities identified in two key web applications were insufficient. Additionally, vulnerabilities identified in workstations (e.g., laptop computers) had not been corrected. We made eight recommendations to address identified weaknesses in incident response, web applications, and patch management. The department concurred with our recommendations and provided an action plan for addressing the identified weaknesses.

Similar to our work, independent reviews at the 24 agencies continued to highlight deficiencies in their implementation of information security policies and procedures. Specifically, for fiscal year 2014, 19 agencies reported that information security control deficiencies were either a material weakness or a significant deficiency in internal controls over their financial reporting. This reflected an increase from fiscal year 2013, when 18 agencies reported that information security control deficiencies were either a material weakness or a significant deficiency in internal controls over their financial reporting. Further, 23 of 24 inspectors general for the agencies cited information security as a “major management challenge” for their agency, reflecting an increase from fiscal year 2013, when 21 inspectors general cited information security as a major challenge. The inspectors general made numerous recommendations to address these issues, as discussed later in this report.

Agencies Exhibited Weaknesses in All Major Categories of Controls

Our reports, agency reports, and inspectors general assessments of information security controls during fiscal years 2013 and 2014 revealed that most of the 24 agencies had weaknesses in each of the five major categories of information system controls: (1) access controls, which limit or detect access to computer resources (data, programs, equipment, and facilities), thereby protecting them against unauthorized modification, loss, and disclosure; (2) configuration management controls, intended to prevent unauthorized changes to information system resources (for example, software programs and hardware configurations) and assure that software is current and known vulnerabilities are patched; (3) segregation of duties, which prevents a single individual from controlling all critical stages of a process by splitting responsibilities between two or more organizational groups; (4) contingency planning, which helps avoid significant disruptions in computer-dependent operations; and (5) agencywide security management, which provides a framework for ensuring that risks are understood and that effective controls are selected, implemented, and operating as intended.

While the number of agencies exhibiting weaknesses decreased slightly in two of five categories, deficiencies were prevalent for the majority of them, as shown in figure 3.

In the following subsections, we discuss the specific information security weaknesses agencies reported for fiscal years 2013 and 2014.

Most Agencies Had Weaknesses in Access Controls

Agencies use electronic and physical controls to limit, prevent, or detect inappropriate access to computer resources (data, equipment, and facilities), thereby protecting them from unauthorized use, modification, disclosure, and loss. Access controls involve the six critical elements described in table 1.

For fiscal years 2013 and 2014, we, agencies, and inspectors general reported weaknesses in access controls for 22 of the 24 agencies. In fiscal year 2014, 12 agencies had weaknesses reported in protecting their networks and system boundaries, a reduction from the 17 agencies that had weaknesses in fiscal year 2013. For example, we found that 1 agency component’s access control lists on a firewall had not prevented traffic coming or initiated from the public internet protocol addresses of a contractor site and a U.S. telecom corporation from entering to its network. Additionally, for fiscal year 2014, 20 agencies had weaknesses reported in their ability to appropriately identify and authenticate system users, a slight increase from 19 of 24 in fiscal year 2013. To illustrate, in fiscal year 2014, 1 agency had not consistently applied proper password settings to mainframe service accounts, where those accounts were configured to never require password changes. Agencies also had weak password controls, such as using system passwords that had not been changed from the easily guessable default passwords.

In fiscal year 2014, 18 agencies had weaknesses reported in authorization controls, a reduction from the 20 agencies that had weaknesses in fiscal year 2013. One example of this weakness for fiscal year 2014 was that 1 agency had not consistently or in a timely manner removed, transferred, and/or terminated employee and contractor access privileges from multiple systems. Another agency had granted access privileges unnecessarily, which allowed users of an internal network to read and write files containing sensitive system information, including passwords, that were used to support automated data transfer operations between numerous systems. In fiscal year 2014, 4 agencies had weaknesses reported in encryption, down from 7 in fiscal year 2013.

In addition, 19 agencies had weaknesses reported in implementing an effective audit and monitoring capability. For instance, 1 agency had not effectively implemented audit and monitoring controls on a system where the servers and network devices were not sufficiently logging security- relevant events. Finally, 10 agencies had weaknesses reported in their ability to restrict physical access or harm to computer resources and protect them from unauthorized loss or impairment. For example, a contractor of an agency was granted physical access to a server room without the required approval of the office director. Without adequate access controls in place, agencies cannot ensure that their information resources are being protected from intentional or unintentional harm.

Agencies Did Not Fully Implement Controls for Configuration Management

Configuration management controls ensure that only authorized and fully tested software is placed in operation, software and hardware is updated, information systems are monitored, patches are applied to these systems to protect against known vulnerabilities, and emergency changes are documented and approved. These controls, which limit and monitor access to powerful programs and sensitive files associated with computer operations, are important in providing reasonable assurance that access controls and the operations of systems and networks are not compromised. To protect against known vulnerabilities, effective procedures must be in place, current versions of vendor-supported software installed, and patches promptly implemented. Up-to-date patch installation helps mitigate known flaws in software code that could be exploited to cause significant damage and enable malicious individuals to read, modify, or delete sensitive information or disrupt operations.

In fiscal year 2014, 22 agencies had weaknesses reported in configuration management, a reduction from the 24 agencies that had weaknesses in fiscal year 2013. For fiscal year 2014, 17 agencies had weaknesses reported with installing software patches and implementing current versions of software in a timely manner, an improvement from the 23 reported in fiscal year 2013. One agency had not installed critical updates in a timely manner for several of its servers. Another agency was using an unsupported software application on its workstations, and a database system used to support the access authorization system was no longer supported. For fiscal year 2014, 14 agencies had weaknesses reported in authorizing, testing, approving, tracking, and controlling configuration changes. In fiscal year 2014, our work revealed that 1 agency had not effectively documented and approved configuration changes. Specifically, the agency did not request or approve 32 changes to mainframe production processing that had been recorded in the system logs.

Without a consistent approach to testing, updating, and patching software, agencies increase their risk of exposing sensitive data to unauthorized and possibly undetected access.

More than Half of the Agencies Did Not Segregate Incompatible Duties

Segregation of duties refers to the policies, procedures, and organizational structure that help to ensure that one individual cannot independently control all key aspects of a computer-related operation and thereby take unauthorized actions or gain unauthorized access to assets or records. Key steps to achieving proper segregation are ensuring that incompatible duties are separated and employees understand their responsibilities, and controlling personnel activities through formal operating procedures, supervision, and review.

In fiscal years 2013 and 2014, 15 agencies had weaknesses reported in implementing segregation of duties controls. For example, in fiscal year 2014, 1 agency had not implemented requirements for separating incompatible duties. Additionally, a developer from another agency had been authorized inappropriate access to the production environment of the agency’s system. Further, another agency had not adequately implemented segregation of duties controls for IT and financial management personnel with access to financial systems across several platforms and environments.

Without adequate segregation of duties, agencies increase the risk that erroneous or fraudulent actions will occur, improper program changes will be implemented, and computer resources will be damaged or destroyed.

Agencies Had Weaknesses in Continuity of Operations

In the event of an act of nature, fire, accident, sabotage, or other disruption, an essential element in preparing for the loss of operational capabilities is having an up-to-date, detailed, and fully tested continuity of operations plan. This plan should cover all key functions, including assessing an agency’s information technology and identifying resources, minimizing potential damage and interruption, developing and documenting the plan, and testing it and making necessary adjustments. If continuity of operations controls are faulty, even relatively minor interruptions can result in lost or incorrectly processed data, which can lead to financial losses, expensive recovery efforts, and inaccurate or incomplete mission-critical information.

Eighteen agencies had weaknesses reported in continuity of operations practices for their agencies in fiscal years 2014 and 2013. Specifically, in 2014, 16 agencies did not have a comprehensive contingency plan. For example, 1 agency’s contingency plans had not been updated to reflect changes in the system boundaries, roles and responsibilities, and lessons learned from testing contingency plans at alternate processing and storage sites. Additionally, 15 agencies had not regularly tested their contingency plans. For example, 1 agency had not annually tested contingency plans for 10 of its 16 systems.

Until agencies address identified weaknesses in their continuity of operations plans and tests of these plans, they may not be able to recover their systems in a successful and timely manner when service disruptions occur.

Agencies Did Not Effectively Manage Security

An underlying cause for information security weaknesses identified at federal agencies is that they have not yet fully or effectively implemented an agency-wide information security program to help them manage their security process. An agency-wide security program, as required by FISMA 2002, provides a framework for assessing and managing risk, including developing and implementing security policies and procedures, conducting security awareness training, monitoring the adequacy of the entity’s computer-related controls through security tests and evaluations, and implementing remedial actions as appropriate. Without a well- designed program, security controls may be inadequate; responsibilities may be unclear, misunderstood, and improperly implemented; and controls may be inconsistently applied. Such conditions may lead to insufficient protection of sensitive or critical resources.

In fiscal year 2014, 23 agencies had weaknesses reported in security management, while 24 had them in fiscal year 2013. In one example, an agency had not fully developed and implemented components of its agency-wide information security risk management program that met FISMA’s requirements. Specifically, the agency had established an enterprise risk management framework; however, security risks had not been fully communicated to data centers, regional offices, and medical facilities. In another example, the agency did not have effective procedures for testing and evaluating controls since the procedures did not prescribe effective tests of authentication controls.

Until agencies fully resolve identified deficiencies in their agency-wide information security programs, they will continue to face significant challenges in protecting their information and systems.

We and Inspectors General Recommended Actions to Strengthen Information Security

Over the last several years, we and agency inspectors general have made hundreds of recommendations to agencies aimed at improving their implementation of information security controls. These recommendations identify actions for agencies to take in protecting their information and systems. For example, we and inspectors general have made recommendations for agencies to correct weaknesses in controls intended to prevent, limit, and detect unauthorized access to computer resources, such as controls for protecting system boundaries, identifying and authenticating users, authorizing users to access systems, encrypting sensitive data, and auditing and monitoring activity on their systems. We have also made recommendations for agencies to implement their information security programs and protect the privacy of PII held on their systems.

However, many agencies continue to have weaknesses in implementing these controls in part because many of these recommendations remain unimplemented. Until federal agencies take actions to implement the recommendations made by us and the inspectors general, federal systems and information as well as sensitive personal information about the public will be at an increased risk of compromise from cyber-based attacks and other threats.

Federal Efforts Are Underway to Improve Security

Due to the increase in cyber security threats, the federal government has initiated or continued several efforts to protect federal information and information systems. The White House, OMB, and federal agencies have launched several government-wide efforts that are intended to enhance information security at federal agencies. These key efforts are discussed here.

Cybersecurity Cross-Agency Priority goals: Initiated in 2012, the cybersecurity Cross-Agency Priority (CAP) goals are an effort intended to focus federal agencies’ cybersecurity activity on the most effective controls. For fiscal years 2013 and 2014, these goals included:

Trusted Internet Connections: Trusted Internet Connections (TIC) aims to improve the federal government’s security posture through the consolidation of external telecommunication connections by establishing a set of baseline security capabilities through enhanced monitoring and situational awareness of all external network connections. OMB established fiscal year 2014 targets of 95 percent for TIC consolidation and 100 percent for implementing TIC capabilities. OMB reported that agencies had achieved 95 and 92 percent implementation, respectively, for these TIC goals in fiscal year 2014.

Continuous monitoring: Intended to provide near real-time security status and remediation, increasing visibility into system operations and helping security personnel make risk management decisions based on increased situational awareness. OMB established a fiscal year 2014 target of 95 percent implementation for continuous monitoring and reported that the agencies had achieved 92 percent implementation.

Strong authentication: Intended to increase the use of federal smartcard credentials, such as personal identity verification and common access cards that provide multifactor authentication and digital signature and encryption capabilities. Strong authentication can provide a higher level of assurance when authorizing users’ access to federal information systems. OMB established a fiscal year 2014 target of 75 percent implementation for strong authentication. In its report on fiscal year 2014 FISMA implementation, OMB indicated that the 24 federal agencies covered by the CFO Act had achieved a combined 72 percent implementation of these requirements, but this number dropped to only 41 percent implementation for the 23 civilian agencies when excluding DOD.

In fiscal year 2015, the administration added the anti-phishing and malware defense as a new goal for the CAP initiative.

The National Cybersecurity Protection System (NCPS): NCPS is a system of systems (also known as EINSTEIN) that is intended to deliver a range of capabilities including intrusion detection and prevention, analytics, and information sharing. The goal of EINSTEIN is to provide the federal government with an early warning system, improved situational awareness of intrusion threats, near real-time identification, and prevention of malicious cyber activity. This system was created in 2003 by US-CERT to help reduce and prevent computer network vulnerabilities across the federal government. The capabilities of NCPS are to include network “flow,” intrusion detection, and intrusion prevention functions, as described in table 2.

The Continuous Diagnostics and Mitigation (CDM) Program: CDM is intended to provide federal departments and agencies with a basic set of tools to support the continuous monitoring of information systems. According to DHS, the program is intended to provide federal departments and agencies with capabilities and tools that identify cybersecurity risks on an ongoing basis, prioritize these risks based on potential impacts, and enable cybersecurity personnel to mitigate the most significant problems first. These tools include sensors that perform automated searches for known cyber vulnerabilities, the results of which feed into a dashboard that alerts network managers. These alerts can be prioritized, enabling agencies to allocate resources based on risk. DHS, in partnership with the General Services Administration, has established a government-wide acquisition vehicle to allow federal agencies (as well as state, local, and tribal governmental agencies) to acquire CDM tools at discounted rates.

The National Initiative for Cybersecurity Education (NICE): NICE is an interagency effort coordinated by NIST to improve cybersecurity education, including efforts directed at training, public awareness, and the federal cybersecurity workforce. This initiative is intended to support the federal government’s evolving strategy for education, awareness, and workforce planning and provide a comprehensive cybersecurity education program. To meet NICE objectives, efforts were structured into the following four components: 1. National cybersecurity awareness: This component included public service campaigns to promote cybersecurity and responsible use of the Internet and to make cybersecurity popular for children. It was also aimed at making cybersecurity a popular educational and career pursuit for older students. 2. Formal cybersecurity education: Education programs encompassing K-12, higher education, and vocational programs related to cybersecurity were included in this component, which focused on the science, technology, engineering, and math disciplines to provide a pipeline of skilled workers for private sector and government. 3. Federal cybersecurity workforce structure: This component addressed personnel management functions, including the definition of cybersecurity jobs in the federal government and the skills and competencies they required. Also included were new strategies to ensure federal agencies can attract, recruit, and retain skilled employees to accomplish cybersecurity missions. 4. Cybersecurity workforce training and professional development: Cybersecurity training and professional development for federal government civilian, military, and contractor personnel were included in this component.

The Federal Risk and Authorization Management Program (FedRAMP): FedRAMP is a government-wide program intended to provide a standardized approach to security assessment, authorization, and continuous monitoring for cloud computing products and services.

FedRAMP defines a set of controls for low and moderate impact-level systems according to the baseline controls in NIST SP 800-53 Revision 4 and includes control enhancements related to the unique security requirements of cloud computing. All federal agencies must meet FedRAMP requirements when using cloud services and the cloud service providers must implement the FedRAMP security requirements in their cloud environment.

In addition, the cloud service providers must hire a FedRAMP-approved third-party assessment organization to perform an independent assessment to audit the cloud system and provide a security assessment package for review. The package will then be reviewed by the FedRAMP Joint Authorization Board, which may grant a provisional authorization. Federal agencies can leverage cloud service provider authorization packages for review when granting an agency authority to operate, where this reuse is intended to save time and money. After the cloud provider has received a FedRAMP authorization from the Joint Authorization Board or the agency, it must implement a continuous monitoring capability to ensure the cloud system maintains an acceptable risk posture.

The Cyber and National Security Team (E-Gov Cyber): OMB created the Cyber and National Security Team, called the E-Gov Cyber Unit, to strengthen federal cybersecurity through targeted oversight and policy issuance. The unit and its partners, the National Security Council, DHS, and NIST, are to oversee agency and government-wide cybersecurity programs, and oversee and coordinate the federal response to major cyber incidents and vulnerabilities. OMB reported that the unit found that more than half of incidents occurring at federal agencies could have been prevented by strong authentication. In addition, the unit intends to monitor implementation of critical DHS programs such as NCPS and CDM.

The 30-Day Cybersecurity Sprint: In June 2015, in response to the OPM security breaches and to improve federal cybersecurity and protect systems against evolving threats, the Federal Chief Information Officer launched the 30-day Cybersecurity Sprint. As part of this effort, the Federal Chief Information Officer instructed federal agencies to immediately take a number of steps to further protect federal information and assets and to improve the resilience of federal networks. Specifically, federal agencies were to: Immediately deploy indicators provided by DHS regarding priority threat actor techniques, tactics, and procedures to scan systems and check logs. Agencies were to inform DHS immediately if indicators return evidence of malicious cyber activity.

Patch critical vulnerabilities without delay. The vast majority of cyber intrusions exploit well-known vulnerabilities that are easy to identify and correct. Agencies were to take immediate action on the DHS vulnerability scan reports they receive each week and report to OMB and DHS on progress and challenges within 30 days.

Tighten policies and practices for privileged users. To the greatest extent possible, agencies were to minimize the number of privileged users; limit functions that can be performed when using privileged accounts; limit the duration that privileged users can be logged in; limit the privileged functions that can be performed using remote access; and ensure that privileged user activities are logged and that such logs are reviewed regularly. Agencies were to report to OMB and DHS on progress and challenges within 30 days.

Dramatically accelerate implementation of multi-factor authentication, especially for privileged users. Intruders can easily steal or guess usernames/passwords and use them to gain access to federal networks, systems, and data. Requiring the use of a personal identity verification card or alternative form of multi-factor authentication can significantly reduce the risk of adversaries penetrating federal networks and systems. Agencies were to report to OMB and DHS on progress and challenges in implementation of these enhanced security requirements within 30 days.

In addition to providing guidance to the agencies, the Federal Chief Information Officer established the Cybersecurity Sprint Team to lead a review of the federal government’s cybersecurity policies, procedures, and practices. According to OMB, the team is comprised of OMB’s E-Gov Cyber and National Security Unit, the National Security Council Cybersecurity Directorate, DHS, and DOD. At the end of the review, the Federal Chief Information Officer is to create and operationalize a set of action plans and strategies to further address critical cybersecurity priorities and recommend a federal civilian cybersecurity strategy. Key principles of the strategy are to include:

Protecting data: Better protect data at rest and in transit.

Improving situational awareness: Improve indication and warning. Increasing cybersecurity proficiency: Ensure a robust capacity to recruit and retain cybersecurity personnel. Increasing awareness: Improve overall risk awareness by all users.

Standardizing and automating processes: Decrease time needed to manage configurations and patch vulnerabilities.

Controlling, containing, and recovering from incidents: Contain malware proliferation, privilege escalation, and lateral movement. Quickly identify and resolve events and incidents.

Strengthening systems Life-cycle security: Increase inherent security of platforms by buying more secure systems and retiring legacy systems in a timely manner.

Reducing attack surfaces: Decrease complexity and number of things defenders need to protect.

Successful implementation of these government-wide efforts will be key steps to improving cybersecurity at federal agencies.

Agencies’ Implementation of FISMA 2002 Requirements Was Mixed

The extent of agencies’ implementation of FISMA 2002 requirements for establishing and maintaining an information security program from fiscal year 2013 to fiscal year 2014 varied. For example, according to the reports by the inspectors general of the 24 CFO Act agencies, the number of agencies implementing risk management activities and documenting policies and procedures increased while the number of agencies planning for security, providing security training, and testing controls decreased. In addition, agency inspectors general, NIST, and OMB, with support from DHS, continued to address their responsibilities under FISMA 2002, but opportunities remain for improving FISMA reporting.

More Agencies Implemented Risk Management Activities

FISMA 2002 required that agencies periodically assess the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems. These risk assessments help determine whether controls are in place to remediate or mitigate risk to the agency. NIST has issued several guides for managing risk.

According to NIST’s Guide for Applying the Risk Management Framework to Federal Information Systems, risk management is addressed at the organization level, the mission and business process level, and the information system level. Risks are addressed from an organizational perspective with the development of, among other things, risk management policies, procedures, and strategy. The risk decisions made at the organizational level are to guide the entire risk management program. In addition, the activities for the risks that are addressed at the mission and business process levels include, among other things, defining and prioritizing the agency’s mission and business processes and developing an organization-wide information protection strategy. There are various risk management activities for the risks that are addressed at the information system level, including categorizing organizational information systems, allocating security controls to organizational information systems, and managing the selection, implementation, assessment, authorization, and ongoing monitoring of security controls.

For fiscal years 2014 and 2013, inspectors general reported that 12 agencies had addressed risk from an organization perspective. In fiscal year 2014, inspectors general reported that 16 of 24 agencies had addressed risk from a mission or business perspective compared to 14 in fiscal year 2013. According to inspectors general, for fiscal years 2013 and 2014, 16 agencies had addressed risk from an information system perspective. Figure 4 shows examples of agencies’ implementation of risk management program elements for fiscal years 2013 and 2014.

However, work by the inspectors general revealed weaknesses in risk management. According to OMB, inspectors general at seven agencies reported that their agency did not have a risk management program in place. The inspector general for one agency reported that, although the agency had implemented a risk governance structure, it had not fully identified or mitigated the enterprise-wide risks with appropriate risk mitigation strategies. Another inspector general reported that its agency did not have a current risk assessment for three of the seven systems in the sample. Managing risk is the center of an effective information security program; without effective risk management, agencies may not be fully aware of the risks to essential computing resources and may not be able to make informed decisions about needed security protections.

Most Agencies Had Documented Policies and Procedures

FISMA 2002 required agencies to develop, document, and implement policies and procedures that are based on risk assessments; cost-effectively reduce information security risks to an acceptable level; ensure that information security is addressed throughout the life cycle of each agency’s information system; and ensure compliance with FISMA 2002 requirements, OMB policies and procedures, minimally acceptable system configuration requirements, and any other applicable requirements.

In fiscal years 2014 and 2013, most agency inspectors general reported that their agency had documented policies and procedures that were consistent with federal guidelines and requirements. Specifically, the number of agencies that documented policies and procedures increased in 8 of 11 categories, and remained the same in 3 categories since one inspector general did not report on these. Table 3 summarizes agencies’ performance for fiscal years 2013 and 2014.

In our prior work, we have also identified weakness in agencies policies and procedures for information security. In fiscal year 2014, we reported that six agencies we reviewed had not fully developed comprehensive policies and procedures for incident response. For example, only two of the six selected agencies had fully implemented policies that addressed roles, responsibilities, and levels of authority for incident response. Similarly, we reported that several agencies had not established policies and procedures to oversee or assess the security of contractor systems. Further, we found that one agency component’s mainframe security policy did not address who can administer the security software configurations that control access to mainframe programs. We recommended that these agencies develop and update policies and procedures for these areas. The agencies generally concurred with our recommendations.

Until all agencies properly document and implement policies and procedures, they may not be able to effectively reduce risks to their information and information systems, and the information security practices that are driven by these policies and procedures may be applied inconsistently.

Number of Agencies with Sufficient Security Planning Decreased

FISMA 2002 required agencies’ information security programs to include plans for providing adequate information security for networks, facilities, and systems or groups of information systems, as appropriate. According to NIST, the purpose of a system security plan is to provide an overview of the security requirements of the system and describe the controls in place or planned for meeting those requirements. The first step in the system security planning process is to categorize the system based on the impact to agency operations, assets, and personnel should the confidentiality, integrity, and availability of the agency’s information and information systems be compromised. This categorization is then used to determine the appropriate security controls needed for each system. Another key step is selecting a baseline of security controls for each system and documenting those controls in the security plan.

In addition, NIST recommends that the plan be reviewed and updated at least annually. According to NIST, the security authorization package documents the results of the security control assessment and provides the authorizing official with essential information needed to make a risk- based decision on whether to authorize operation of an information system or a designated set of common controls. The package contains a security plan, security assessment report, and plan of action and milestones (POA&M). DHS’s fiscal year 2014 reporting instructions request inspectors general to report on their agencies implementation of certain program attributes such as whether (1) the agency has categorized information systems, (2) its security authorization package contained system security plan, security assessment report, POA&M, and accreditation boundaries, and (3) it has selected and implemented a tailored set of baseline security controls.

In fiscal year 2014, agency inspectors general at 18 agencies reported that their agency had categorized information systems in accordance with federal policies, a decrease from fiscal year 2013, in which 19 inspectors general reported that their agency had categorized their systems. In addition, fewer agencies selected an appropriately tailored set of baseline security controls. For instance, in fiscal year 2014, 15 inspectors general stated that their agency had appropriately selected a baseline of security controls, while 16 had reported for fiscal year 2013. In addition, in fiscal year 2014, 13 inspectors general reported that their agency had implemented a tailored set of baseline security controls, another decrease from fiscal year 2013, in which 14 agencies were reported for such controls.

For fiscal year 2014, according to the inspectors general, 15 agencies had completed a security authorization package that contained a system security plan; 8 had not completed one; and 1 inspector general responded that the question was “not applicable.” This is a decrease from fiscal year 2013, where 17 agencies had included such a security authorization package. In addition, inspectors general at 11 agencies reported that their agency had not always completed or properly updated their security plan. For example, a component of 1 agency had not completed one or more key elements of its system security plan, such as defining the system’s accreditation boundary. Further, at another agency, five systems had been placed into production without a system security plan.

Until agencies appropriately develop and update their system security plans, officials will not be aware of system security requirements or whether controls are in place.

Number of Agencies Providing Sufficient Security Awareness Decreased and the Percentage of Personnel Receiving Specialized Training Decreased

FISMA 2002 required agencies to provide security awareness training to personnel, including contractors and other users of information systems that support the operations and assets of the agency. Training is intended to inform agency personnel of the information security risks associated with their activities and their responsibilities in complying with agency policies and procedures designed to reduce these risks. FISMA 2002 also requires agencies to train and oversee personnel who have significant information security responsibilities. Providing training to agency personnel is critical to securing information and systems because people are one of the weakest links when securing systems and networks.

For fiscal year 2014, fewer agencies reported that at least 90 percent of their users had received security awareness training. The chief information officers for 22 agencies reported that they had provided annual security awareness training to at least 90 percent or more of their network users, which was a decrease from fiscal year 2013, when all 24 agencies reported that they had provided such training. Agency inspectors general reported similar results. For fiscal year 2014, inspectors general for 20 agencies reported that their agency had established a security awareness and training program, which was a decrease from fiscal year 2013, in which 21 agencies had established one. Similarly, they reported that fewer agencies had identified and tracked the status of security awareness training. Specifically, inspectors general for 16 agencies reported that their agency had identified and tracked the status of security awareness training in fiscal year 2014, a decrease from fiscal year 2013, in which 19 agencies had identified and tracked such training.

For fiscal year 2014, the percentage of personnel with significant security responsibilities who received training decreased from the previous year. In February 2015, OMB reported that, for fiscal year 2014, the 24 agencies provided training to an average of 80 percent of personnel who have significant security responsibilities, which reflects a decrease from the 92 percent reported for fiscal year 2013.

Without effective security awareness training, agency personnel may not have a basic understanding of information security requirements to protect the systems they use. In addition, personnel who did not take specialized training may lack the knowledge, skills, and abilities consistent with their roles to protect the confidentiality, integrity, and availability of the information housed within the information systems to which they are assigned.

Fewer Agencies Are Periodically Testing and Continuously Monitoring Controls

FISMA 2002 required that federal agencies periodically test and evaluate the effectiveness of their information security policies, procedures, and practices as part of implementing an agency-wide security program. This testing is to be performed with a frequency depending on risk, but no less than annually. Testing should include management, operational, and technical controls for every system identified in the agency’s required inventory of major systems. This type of oversight is a fundamental element that demonstrates management’s commitment to the security program, reminds employees of their roles and responsibilities, and identifies and mitigates areas of noncompliance and ineffectiveness. Although control tests and evaluations may encourage compliance with security policies, the full benefits are not achieved unless the results are used to improve security.

For fiscal year 2014, inspectors general reported that fewer agencies had tested and evaluated security controls using appropriate assessment procedures to determine the extent to which the controls had been implemented correctly, operated as intended, and produced the desired outcome with respect to meeting the security requirements for the system. In fiscal year 2014, 16 inspectors general reported that their agency had assessed security controls, while 17 agencies had assessed such controls in fiscal year 2013.

As part of government-wide efforts to improve the testing of controls, agencies have begun steps to implement continuous monitoring of their systems. According to NIST, the goal of continuous monitoring is to transform the otherwise static test and evaluation process into a dynamic risk mitigation program that provides essential, near real-time security status and remediation. NIST defines information system continuous monitoring as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. Since March 2012, continuous monitoring has also been designated as a cross-agency priority area for improving federal cybersecurity.

Although OMB reported overall increases in the 24 agencies’ continuous monitoring (from 81 percent in fiscal year 2013 to 92 percent in fiscal year 2014) of controls, inspectors general reported that fewer agencies had continuously monitored controls for their systems. For example, for fiscal year 2014, 12 inspectors general stated that their agency had ensured information security controls were being monitored on an ongoing basis, including assessing control effectiveness, documenting changes to the system or its environment of operation, conducting a security impact analysis of the associated changes, and reporting the security state of the system to designated organizational officials. This is a decrease from fiscal year 2013, when 14 agencies had monitored security controls on an ongoing basis.

If controls are not effectively tested or properly monitored, agencies will have less assurance that they have been implemented correctly, are operating as intended, and are producing the desired outcome with respect to meeting the security requirements of the agency.

Increasing Number of Agencies are Generally Implementing Elements of a Remediation Program, but Weaknesses Remain

FISMA 2002 required agencies to plan, implement, evaluate, and document remedial actions to address any deficiencies in their information security policies, procedures, and practices. In addition, NIST guidance states that federal agencies should develop a POA&M for information systems to document the agency’s planned remedial actions to correct weaknesses or deficiencies noted during the assessment of the security controls and to reduce or eliminate known vulnerabilities in the system. Furthermore, the POA&M should identify, among other things, the resources required to accomplish the tasks, and scheduled completion dates for the milestones. According to OMB, remediation plans assist agencies in identifying, assessing, prioritizing, and monitoring the progress of corrective efforts for security weaknesses found in programs and systems.

For fiscal year 2014, the number of agencies implementing certain elements of their remediation programs increased or remained the same. For fiscal year 2014, inspectors general reported that 16 agencies had tracked, prioritized, and remediated weaknesses, compared to 15 for fiscal year 2013. In addition, 11 agencies had established and adhered to milestone remediation dates in both fiscal years. Further, 16 agencies were reported having an effective remedial action plan in fiscal year 2014, an increase from fiscal year 2013, in which 14 reported having such a plan. For fiscal year 2014, 16 inspectors general reported that their agency had ensured resources and ownership were provided for correcting weaknesses, which is also an increase from 14 in fiscal year 2013. Figure 5 shows agencies’ remediation program efforts for fiscal years 2013 to 2014.

In spite of these increases, inspectors general reported, that for fiscal year 2014, 19 agencies had established a remediation program, which was a slight decrease from fiscal year 2013, in which 20 inspectors general reported such a program. In addition, 18 agencies had weaknesses in remediating information security weaknesses in fiscal year 2014. For example, according to the inspector general, components of one agency had inaccurate milestones, did not identify resources to mitigate weaknesses, and had delays in resolving the weaknesses. The Inspector General of that agency also identified 517 milestones that were past due by 12 months.

Without a sound remediation process, agencies have limited assurance that information security weaknesses are being corrected and addressed in a timely manner.

Agencies’ Efforts to Implement Incident Response and Reporting Varied

FISMA 2002 required that agency security programs include procedures for detecting, reporting, and responding to security incidents and that agencies report incidents to US-CERT. According to NIST, incident response capabilities are necessary for rapidly detecting an incident, minimizing loss and destruction, mitigating the weaknesses that were exploited, and restoring computing services.

From fiscal year 2013 to fiscal year 2014, agencies’ incident response efforts varied. For fiscal year 2014, inspectors general reported that 21 agencies had established an incident response program, which is a slight decrease from fiscal year 2013, in which 22 agencies had established a program. The number of agencies that had routinely reported security incidents to US-CERT within the established time frame also decreased from fiscal year 2013 to fiscal year 2014. Specifically, inspectors general reported that, for fiscal year 2014, 13 agencies had reported incidents to US-CERT within the established time frame, which was a decrease from fiscal year 2013, in which 17 agencies had reported in a timely manner.

Similarly, the number of agencies responding to and resolving incidents also decreased. Specifically, inspectors general reported that, in fiscal year 2014, 15 agencies had responded to and resolved incidents in a timely manner, a decrease from fiscal year 2013, in which 19 agencies had done so. Similar to fiscal year 2013, in fiscal year 2014, according to the inspectors general, 18 agencies had sufficient incident monitoring and detection coverage.

However, inspectors general reported that, in fiscal year 2014, 19 agencies reported incidents to law enforcement, an improvement from fiscal year 2013, in which 18 agencies had done so. Table 4 summarizes agency incident reporting and response practices for fiscal years 2013 and 2014.

Also, 19 agencies had performed a comprehensive analysis, validation, and documentation of incidents in fiscal year 2014, an improvement of 1 agency over the 18 reported in fiscal year 2013, according to the inspectors general.

Effectively implementing a comprehensive incident detection, reporting, and response program can help agencies better protect their information and information systems from cyber attacks.

Fewer Agencies Had Adequate Contingency Plans

FISMA 2002 required federal agencies to implement plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. According to NIST, contingency planning is part of overall information system continuity of operations planning, which fits into a much broader security and emergency management effort that includes, among other things, organizational and business process continuity and disaster recovery planning. These plans and procedures are essential steps in ensuring that agencies are adequately prepared to cope with the loss of operational capabilities due to a service disruption such as an act of nature, fire, accident, or sabotage. According to NIST, these plans should cover all key functions, including assessing an agency’s IT and identifying resources, minimizing potential damage and interruption, developing and documenting the plan, and testing it and making the necessary adjustments.

Similar to fiscal year 2013, in fiscal year 2014, according to the inspectors general, 17 agencies had established a business continuity and disaster recovery program that was consistent with FISMA 2002 requirements, OMB policy, and applicable NIST guidelines.

The number of agencies that had fully implemented certain key elements of their business continuity and disaster recovery programs decreased, according to the inspectors general. For example, 12 agencies had documented business continuity and disaster recovery plans, a decrease from fiscal year 2013, in which 18 agencies had documented such plans. The inspectors general also reported that several agencies lacked other important elements of a continuity of operations program in fiscal year 2014. For example, 10 agencies had not tested their disaster recovery and business continuity plans, and half of the agencies had not tested system-specific contingency plans. In addition, 7 agencies had not developed or tested contingency plans, trained employees for contingencies, or conducted contingency planning exercises. Further, inspectors general reported that 6 agencies had not established an alternate processing site for some systems, and 4 agencies had not backed up information in a timely manner.

Weaknesses in continuity of operations could lessen the effectiveness of agencies’ efforts to successfully recover their systems in a timely manner after a service disruption occurs.

Agencies Reported Operating Fewer Systems and Relying More on Contractor-Operated Systems

FISMA 2002 required agencies to maintain and update annually an inventory of major information systems (systems) operated by the agency or under its control, which includes an identification of the interfaces between each system and all other systems or networks, including those not operated by or under the control of the agency. For fiscal years 2013 and 2014, OMB required agencies to report the number of agency and contractor systems by impact levels.

For fiscal year 2014, the 24 agencies reported a total of 9,906 systems, composed of 8,378 agency and 1,528 contractor systems, as shown by impact level in table 5. This represents a slight decrease in the total number of systems from fiscal year 2013, with the number of agency systems decreasing and the number of contractor systems increasing slightly. With respect to impact levels, the total number of low-impact systems decreased while all others, including the number of uncategorized systems, increased. Appendix III lists the number of systems by impact level for each agency, where all agencies reported having moderate-impact systems, five agencies reported not having any high-impact systems, and one agency reported not having any low-impact systems.

Table 5 shows the number of agency and contractor-operated systems by impact level in fiscal years 2013 and 2014.

In fiscal years 2013 and 2014, OMB also requested that inspectors general report on agencies’ management of contractor systems. Inspectors general reported that 14 agencies had obtained sufficient assurance that security controls of contractor-operated systems and services had been effectively implemented, compared to 13 in fiscal year 2013.

In August 2014, we reported that five of six agencies we reviewed were inconsistent in overseeing assessments of contractors’ implementation of security controls, partly because the agencies had not documented security procedures for effectively overseeing contractor performance. We recommended that five of the six agencies develop procedures for the oversight of contractors. The five agencies generally agreed with the recommendations.

More Agencies Implemented Privacy Requirements

Statutory requirements for the protection of personal privacy by federal agencies are primarily established by the Privacy Act of 1974 and the privacy provisions of the E-Government Act of 2002. In addition, FISMA 2002 addressed the protection of personal information in the context of securing federal agency information and information systems. In addition to these laws, OMB and NIST have issued guidance for assisting agencies with implementing federal privacy laws. In addition, as part of the annual FISMA reporting process, agencies are required by OMB to report on their progress in implementing federal requirements for protecting the privacy of PII. The requirements include reporting on the implementation of privacy policies and procedures and whether a privacy impact assessment was conducted for systems containing PII.

Agencies reported making progress in implementing federal privacy requirements. For fiscal years 2013 and 2014, according to information from senior agency privacy officials, all 24 agencies reported having written policies and processes for their privacy impact assessment practices. According to OMB, in fiscal year 2014, 95 percent of applicable systems reported by the 24 agencies also had an up-to-date privacy impact assessment.

Amount of Spending on Information Security Varied Among Agencies

Each year, OMB requires agencies to report how much their agency spends on information security. From fiscal year 2010 to fiscal year 2014, the 24 agencies reported spending anywhere between 10.3 and 14.6 billion dollars annually on cybersecurity, including 12.7 billion in fiscal year 2014, which is a 23 percent increase from fiscal year 2013 (see fig. 6).

For fiscal years 2013 and 2014, agencies reported information security spending in areas that include 1) preventing malicious cyber activity; 2) detecting, analyzing, and mitigating intrusions; and 3) shaping the cybersecurity environment. The amounts the agencies reported spending in fiscal year 2014 in these three areas are shown in table 6.

NIST Continues to Provide FISMA-Related Guidance to Agencies

FISMA 2002 established NIST’s role of developing information security standards and guidelines for federal agencies such as the Federal Information Processing Standards and the special publications in the 800- series for non-national security federal information systems and assigned NIST some specific responsibilities, including the development of:

Standards to be used by federal agencies to categorize information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels.

Guidelines recommending the types of information and information systems to be included in each category.

Minimum information security requirements (management, operational, and technical security controls) for information and information systems in each such category.

To meet these responsibilities, NIST has continued providing information security guidelines and updates to existing publications. For example, in June of 2014, NIST published Supplemental Guidance on Ongoing Authorization, at the request of OMB. This white paper discusses the current set of NIST guidance, and how it supports concepts of ongoing authorizations. Additionally, in September 2014, NIST issued Special Publication 800-56B, Rev. 1: Recommendation for Pair-Wise Key- Establishment Schemes Using Integer Factorization Cryptography. This publication is intended to provide vendors with information for implementing encryption requirements according to FIPS 140-2.

Table 7 lists the dates for FISMA-related publications that NIST plans to update and issue.

Inspectors General Report on Agency Implementation of FISMA

FISMA 2002 required that agencies have an independent evaluation performed each year to evaluate the effectiveness of the agency’s information security program and practices. FISMA 2002 also required this evaluation to include (1) testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the agency’s information systems and (2) an assessment of compliance with FISMA 2002 requirements, related information security policies, and procedures. For agencies with an inspector general, FISMA 2002 required that these evaluations be performed by the inspector general or an independent external auditor. Lastly, FISMA 2002 required that each year, agencies submit the results of these evaluations to OMB and that OMB summarize the results of the evaluations in its annual report to Congress. According to OMB, the metrics for inspectors general were designed to measure the effectiveness of agencies’ information security programs. OMB relies on the responses by inspectors general to gauge the effectiveness of information security program processes.

Agency inspectors general identified weaknesses in agency information security programs and practices in fiscal years 2013 and 2014. They responded to most of the DHS-defined metrics for reporting on agency implementation of FISMA 2002’s requirements, and most also issued a detailed audit report discussing the results of their evaluation of agency policies, procedures, and practices.

OMB and DHS Continue Actions, but Opportunities Remain for Improving Annual Reporting of Agency Information Security Programs

FISMA 2002 required that OMB, among other things, oversee and annually report to Congress on agencies’ implementation of information security policies, standards, and guidelines. To support its oversight responsibilities, OMB assigned responsibilities to DHS, including overseeing and assisting government efforts to provide adequate, risk- based, cost-effective cybersecurity. OMB and DHS have continued overseeing and assisting agencies with implementing and reporting on cybersecurity, including the following:

CyberStat sessions: According to OMB, these sessions were held with agencies to ensure they are accountable for their cybersecurity posture and to assist them in developing a focused strategy for improving their information security. According to a DHS official, these sessions were held with eight agencies during fiscal year 2013 and four agencies during fiscal year 2014. Beginning in fiscal year 2015, OMB officials stated that that these sessions will be held with agencies with high risk factors, as determined by cybersecurity performance and incident data.

Cybersecurity metrics: Each year, OMB and DHS provide metrics to federal agencies and their inspectors general for preparing FISMA reports that DHS summarizes for OMB’s report to Congress. The metrics listed in the reporting guidance help to form the basis for information on agencies’ progress in implementing FISMA requirements and in determining whether agencies have met certain cybersecurity goals set by the current administration.

Proactive scans of publicly-facing agency networks: In October 2014, OMB instructed DHS and federal agencies to implement a process that allows DHS to conduct regular and proactive vulnerability scans of the publicly-facing segments of the agencies’ networks. In addition, DHS is to provide federal agencies with specific results of the scans; offer additional risk and vulnerability assessment services at the request of individual agencies; and report to OMB on the identification and mitigation of risks and vulnerabilities across federal agencies’ information systems. According to a DHS official, the department began these scans in February 2015 and has been issuing more than 100 reports per week to federal departments and agencies.

In addition, OMB satisfied its FISMA 2002 requirement to annually report to Congress not later than March 1 of each year on agencies’ implementation of the act. OMB transmitted its fiscal year 2014 report on February 27, 2015, to Congress and the Comptroller General. The report highlighted improvements across the federal government such as increases for CAP goals in continuous monitoring, strong authentication, and implementing TIC capabilities. Notwithstanding these improvements, agencies and their inspectors general could further benefit from improved guidance for reporting measures of performance, as described in the next section.

Guidance for Reporting Agency Evaluations Was Not always Complete

FISMA 2002 specified that OMB, among its other responsibilities, is to develop policies, principles, standards, and guidelines on information security and report to Congress. Each year, OMB and DHS provide guidance to federal agencies and their inspectors general for preparing their FISMA reports and then summarize the information provided by the agencies and the inspectors general in OMB’s annual report to Congress.

For fiscal year 2014 annual FISMA reporting, DHS requested that inspectors general assess their agency’s security program in 11 program components (e.g. continuous monitoring, configuration management, security training, among others). For 9 of the 11 program components, the inspector general is first asked to conclude on whether its agency has established a program component that is consistent with FISMA 2002 requirements, OMB policy, and applicable NIST guidelines. Inspectors general are then asked subsequent questions as to whether the program components include certain attributes listed in the reporting instructions. These attributes consist of 5 to 16 additional questions such as whether the agency has documented policies and procedures for that program component or has implemented controls related to that component. Inspectors general are asked to respond to their overall assessment of each program component and the individual attributes using “yes” or “no” responses.

Our review of fiscal year 2014 responses by inspectors general revealed that the reporting guidance was not complete. The lack of appropriate guidance was illustrated by the inconsistent responses to questions supporting their overall evaluation for each of the 11 agency program components. For example, in fiscal year 2014, 19 inspectors general reported that their agency had implemented a continuous monitoring program. Seventeen of the 19 inspectors general reported that their agency’s continuous monitoring program included at least 4 of 7 seven attributes or that the attribute was not applicable. However, two of the inspectors general reported their agency had implemented a continuous monitoring program, although those agencies had implemented only 2 of 7 attributes required for the program area.

Other examples we identified illustrate inconsistent inspector general interpretation in reporting. Fifteen of 24 inspectors general reported that their agency had a configuration management program in place and that the program included at least 5 (50 percent) or more of the 10 attributes or that they had not reviewed those attributes. However, 3 other inspectors general reported that their agency had not implemented a configuration management program, even though their program also included at least 5 (50 percent) or more of the 10 attributes. In addition, another inspector general responded that the program was in place, although only 2 of the 10 configuration management attributes were included in the agency’s program.

In our follow-up with the inspectors general, three provided responses illustrating inconsistencies with how they interpreted the annual reporting guidance. Specifically, one pointed out that he based his overall top-level response of “yes” for the program areas on whether more than 50 percent of the attributes were in place at his agency. Another replied that, in addition to OMB and DHS guidance, his agency used an internal threshold of 70 percent for a “yes” answer and that 69 percent and below would result in a “no.” The third inspector general responded that he had reviewed five key elements for each component and then evaluated each of the 11 program components by determining whether (1) policies and procedures were in place, (2) controls were designed per policies and procedures, (3) controls were implemented, and (4) controls were operating as intended. These variations in how the guidance was interpreted suggest that additional information on how to incorporate the attributes into the overall conclusion could be valuable in ensuring consistent reporting.

The reporting guidance asks inspectors general for an overall assessment of each program component, but does not define criteria for inspectors general to provide a “yes” or “no” response on whether the program component is implemented. In addition, the guidance does not identify the extent (number or percent of attributes needed for a “yes”) to which the attributes should be considered into the overall assessment for each of the components. Therefore, based on our analysis, it appears that some inspectors general reached the same overall assessment, but varied in how those attributes affected their rating. Without complete instructions, differing interpretations of the guidance may therefore result in responses by inspectors general that are not always comparable for presenting a clear government-wide picture of agencies’ information security implementation.

Clarifying reporting guidance to inspectors general for the program areas they evaluate would further enhance the quality and consistency of information reported on the government-wide status of federal agencies’ implementation of information security policies, procedures, and practices. Without consistent criteria for reporting, inspectors general may be providing Congress and other oversight bodies with uneven information on the extent to which federal agencies are effectively implementing security requirements.

In the past, we have reported that performance information derived from FISMA reporting provides valuable information on the status and progress of agency efforts to implement effective security management programs, but that shortcomings in the reporting process needed to be addressed. For example, we previously recommended that OMB and DHS provide insight into agencies’ security programs by developing additional metrics for key security areas such as those for periodically assessing risk and developing subordinate security plans. We also recommended that metrics for FISMA reporting be developed to allow inspectors general to report on the effectiveness of agencies’ information security programs. OMB and DHS have not yet fully implemented these recommendations.

Conclusions

Federal agencies’ information and systems remain at a high risk of unauthorized access, use, disclosure, modification, and disruption. These risks are illustrated by the wide array of cyber threats, an increasing number of cyber incidents, and breaches of PII occurring at federal agencies. Agencies also continue to experience weaknesses with effectively implementing security controls, such as those for access, configuration management, and segregation of duties. OMB and federal agencies have initiated actions intended to enhance information security at federal agencies. Nevertheless, persistent weaknesses at agencies and breaches of PII demonstrate the need for improved security. Until agencies correct longstanding control deficiencies and address the hundreds of recommendations that we and agency inspectors general have made, federal systems will remain at increased and unnecessary risk of attack or compromise.

Federal agencies’ implementation of FISMA during fiscal years 2013 and 2014 was mixed. The number of agencies fully implementing components of their security programs increased for some elements, such as developing and documenting policies and procedures, but decreased in others, such as testing controls or providing security training, and varied in implementing incident response and reporting. During fiscal years 2013 and 2014, inspectors general continued to identify weaknesses with the processes agencies used for implementing components of their programs. As a result, agencies are not effectively implementing the risk- based activities necessary for an effective security program required under FISMA 2002 and continued under FISMA 2014.

Although OMB and DHS have increased oversight and assistance to federal agencies in implementing and reporting on information security programs, inconsistencies remain in reporting by inspectors general. Some of these inconsistencies could be alleviated with revised guidance from OMB and DHS. Shortcomings in reporting could result in uneven information being provided to Congress and other oversight entities and limit their ability to compare the extent to which federal agencies are implementing information security programs.

Recommendation for Executive Action

We recommend that the Director of the Office of Management and Budget, in consultation with the Secretary of Homeland Security, the Chief Information Officers Council, and the Council of the Inspectors General on Integrity and Efficiency, enhance reporting guidance to the inspectors general for all rating components of agency security programs, such as configuration management and risk management, so that the ratings will be consistent and comparable.

Agency Comments and Our Evaluation

We provided a draft of this report to OMB; DHS; the Departments of Commerce, State, and Treasury; General Services Administration; National Science Foundation; and the Social Security Administration. According to a representative from OMB, the agency generally concurred with our recommendation and provided these comments. During fiscal year 2015, OMB worked with DHS and the Intelligence Community to develop and refine the FY 2016 FISMA metrics. Additionally, OMB continued to work with DHS and the Intelligence Community and has worked with the Chief Information Officers Council and the Information Technology Committee for the Council of the Inspectors General on Integrity and Efficiency to improve the reporting process and enhance FISMA reporting guidance for the inspector general community, respectively.

In written comments (reproduced in appendix IV), SSA’s Executive Counselor to the Commissioner stated that the agency takes a proactive approach to identifying and mitigating risk associated with access to their secure network. In e-mail responses, the audit liaison for DHS and Commerce provided technical comments, which we have incorporated as appropriate. Officials from the Departments of State and Treasury, the General Services Administration, and the National Science Foundation responded that their agency did not have any comments.

We are sending copies of this report to the Director of the Office of Management and Budget, the Secretary of Homeland Security, and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov.

If you have any questions regarding this report, please contact me at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to evaluate (1) the adequacy and effectiveness of federal agencies’ information security policies and procedures and (2) the extent to which federal agencies have implemented the requirements of the Federal Information Security Management Act (FISMA) of 2002.

To assess the adequacy and effectiveness of agencies’ information security policies and practices, we reviewed and analyzed our, agency, and inspectors general information security-related reports that were issued from October 2013 through May 2015 and covered agencies’ fiscal years 2013 and 2014 security efforts. We reviewed and summarized weaknesses identified in these reports using the five major categories of information security general controls identified in our Federal Information System Controls Audit Manual: (1) access controls, (2) configuration management controls, (3) segregation of duties, (4) contingency planning, and (5) security management controls. In addition, we reviewed and analyzed financial and performance and accountability reports of the 24 major federal agencies covered by the Chief Financial Officers Act for fiscal years 2013 and 2014.

To evaluate the extent to which the agencies have implemented FISMA’s requirements, we reviewed and analyzed the provisions of the 2002 act. We reviewed and analyzed the provisions of the act to identify agency, Office of Management and Budget (OMB), Department of Homeland Security (DHS), and National Institute of Standards and Technology (NIST) responsibilities for implementing, overseeing, and providing guidance for agency information security. We did not evaluate agencies’ implementation of the Federal Information Security Modernization Act of 2014 (FISMA 2014), but we compared it to the 2002 act’s requirements to identify revised responsibilities for OMB, DHS, and federal agencies. We also reviewed OMB and DHS’ annual FISMA reporting guidance, and OMB’s annual reports to Congress for fiscal years 2013 and 2014 FISMA implementation. In addition, we analyzed, categorized, and summarized the annual FISMA data submissions for fiscal years 2013 and 2014 by each agency’s chief information officer, inspector general, and senior agency official for privacy.

To assess the reliability of the agency-submitted data we obtained via CyberScope, we reviewed FISMA reports that agencies provided to corroborate the data. In addition, we selected 6 agencies to gain an understanding of the quality of the processes in place to produce annual FISMA reports. To select these agencies, we sorted the 24 major agencies from highest to lowest using the total number of systems each agency had reported in fiscal year 2013; separated them into even categories of large, medium, and small agencies; then selected the last 2 agencies from each category. These agencies were the Departments of Commerce, State, and the Treasury; the General Services Administration; the National Science Foundation; and the Social Security Administration. We conducted interviews and collected data from the inspectors general and agency officials from the selected agencies to determine the reliability of data submissions. As appropriate, we interviewed officials from OMB, DHS, and NIST. Based on this assessment, we determined that the data were sufficiently reliable for our work.

We conducted this performance audit from December 2014 to September 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Cyber Threats and Exploits

Appendix III: Number of Agency and Contractor-Operated Systems by Impact Level

Appendix III: Number of Agency and Contractor-Operated Systems by Impact Level The Departments of Agriculture (USDA), Commerce, Defense (DOD), Education, Energy, Health and Human Services (HHS), Homeland Security (DHS), Housing and Urban Development (HUD), the Interior, Justice, Labor, State, Transportation, the Treasury, and Veterans Affairs (VA); the Environmental Protection Agency (EPA); General Services Administration (GSA); National Aeronautics and Space Administration (NASA); National Science Foundation (NSF); Nuclear Regulatory Commission (NRC); Office of Personnel Management (OPM); Small Business Administration (SBA); Social Security Administration (SSA); and the U.S. Agency for International Development (USAID).

Appendix IV: Comments from the Social Security Administration

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contacts named above, Larry Crosland (assistant director), Christopher Businsky, Rosanna Guerrero, Nancy Glover, Angel Ip, Fatima Jahan, Carlo Mozo, and Shaunyce Wallace made key contributions to this report.