Federal agencies rely extensively on computerized information systems and electronic data to carry out their missions. The security of these systems and data is essential to prevent data tampering, disruptions in critical operations, fraud, and inappropriate disclosure of sensitive information. Protecting federal computer systems and the systems that support critical infrastructures has never been more important, owing to the ease of obtaining and using hacking tools, the steady advances in the sophistication and effectiveness of attack technology, and the emergence of new and more destructive attacks. Without proper safeguards, there is enormous risk that individuals and groups with malicious intent may intrude into inadequately protected systems and use this access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. Enacted into law on December 17, 2002, as Title III of the E-Government Act of 2002, FISMA authorized and strengthened information security program, evaluation, and reporting requirements. It assigns specific responsibilities to agency heads, chief information officers (CIO), and IGs. It also assigns OMB and the National Institute of Standards and Technology (NIST) with responsibilities with regard to oversight and guidance. Among other things, OMB is responsible for overseeing agency information security policies and practices, including developing and overseeing guidance on information security and overseeing compliance. NIST is tasked with developing standards and guidance for implementation of FISMA requirements by federal agencies. However, 4 years into the implementation of FISMA, many agencies continue to exhibit weaknesses in carrying out the act’s requirements. Overall, FISMA requires each agency to develop, document, and implement an agencywide information security program. This program should provide security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. Among the key activities and responsibilities associated with implementing this program are the following: Development, maintenance, and annual update of an inventory of major information systems (including major national security systems) that are operated by the agency or are under its control. Risk-based policies and procedures that cost-effectively reduce information security risks to an acceptable level and ensure that information security is addressed throughout the life cycle of each information system, including through compliance with minimally acceptable system configuration requirements. Security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency, and training for personnel with significant responsibilities for information security. Periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, performed with a frequency depending on risk, but not less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems. A process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency. In addition, as part of its responsibilities for overseeing the establishment of agency information security programs in accordance with FISMA, OMB requires that systems be certified and accredited, a process by which senior agency officials certify that the risk level of information systems is acceptable and that the systems are approved for operation. Because these key activities are interdependent, weaknesses in one activity challenge the effective accomplishment of other FISMA activities. For example, a complete and accurate system inventory provides a basis for tracking FISMA compliance and for testing the effectiveness of security controls for all systems and their components—necessary to assess system risk. The inventory and risk assessments in turn feed an agency’s strategy for managing risk and maintaining departmental risk- based policies and procedures. Similarly, effectively training personnel strengthens an agency’s ability to properly and consistently implement required security controls and to maintain an effective program over time. To help ensure that agencies are accountable for meeting the act’s requirements, FISMA requires each agency to annually report to OMB, selected congressional committees, and the Comptroller General of the United States on the adequacy of information security policies, procedures, and practices and on compliance with requirements. Agency heads are required to annually report the results of their independent evaluations to OMB. Defense, Homeland Security, Justice, and State face challenges in implementing key information security control activities required by FISMA and OMB, as shown in table 1. The reasons that the departments are challenged in these areas vary. For example, some departments attribute weaknesses to limitations in the tools and processes they use to perform certain activities (such as training and remedial actions). Until the departments address these challenges and fully implement an effective departmentwide information security program, they increase the risk that they may not effectively protect the confidentiality, integrity, and availability of their information and information systems. FISMA and OMB guidance require each agency to develop, maintain, and annually update an inventory of major information systems that are operated by the department or that are under its control. For each system, OMB requires agencies to use their inventories to support information resource management, including monitoring, testing, and evaluation of information security controls. Of the four departments, Homeland Security and Justice reported having complete system inventories. OMB has announced in its FY 2006 Report to Congress on Implementation of The Federal Information Security Management Act of 2002 that Justice’s automated tool will be available to other federal agencies under the information system security line of business. However, Defense and State have not developed accurate and complete FISMA inventories. Since 2004, the IG at Defense has reported that the department does not have a complete and accurate inventory of its major information systems. A contributing factor to this incomplete inventory is that Defense does not have a common definition of an information system. As noted in guidance that the department issued in 2006, Defense policies have at least two definitions of a system, neither of which provides consistent criteria for what should be entered into a FISMA inventory. The 2006 guidance provides a third set of criteria and states that the two policy definitions should act only as a starting point. However, Defense components must make independent interpretations of whether the asset under evaluation should be reported as a system for FISMA purposes, and the varied interpretations create discrepancies in the inventory. For example, Department of the Navy officials stated that not having a common definition of what is an information technology (IT) system makes it virtually impossible to distinguish between a system and its constituent subsystems/applications versus a family of systems and constituent systems. Without establishing and enforcing the use of one common definition, Defense cannot implement consistent inventory management practices across its components. State has developed a definition of a major information system for the purposes of its inventory; however, there is disagreement with its IG regarding how to apply the definition to individual IT assets—either separately or as part of a consolidated system. In 2006, State’s IG found Web applications that State officials had not included separately in their FISMA inventory. Because of time limitations, the IG was unable to determine whether other IT assets were missing from the inventory and rejected the entire FISMA inventory maintained by State. State now has an effort under way to resolve this challenge and identify all Web applications for inclusion in the inventory. If this effort results in agreement with State’s IG, it could help the department in obtaining independent verification of its system inventory. FISMA requires that agency information security programs include risk- based policies and procedures that ensure that information security is addressed throughout the life cycle of each information system, including through compliance with minimally acceptable system configuration requirements. According to the NIST guidance for implementing configuration management requirements, the policies for baseline system configurations provide information about the makeup of a particular system component (e.g., the standard software load for a workstation or notebook computer, including updated patch information). In addition, the system configuration settings are the adjustable parameters of these components that enforce the agency security policy consistent with operational requirements. According to the fiscal year 2006 CIO FISMA reports, all four departments reported that they had established a departmentwide policy for common security configurations. However, as detailed in table 2, only State reported successfully implementing its common configuration policy on all system platforms. State attributes its success to the development and implementation of a strong configuration management compliance program known as “Evaluation and Verification.” According to State, the program conducts remote scans to confirm whether State systems are operating as intended, in accordance with mandatory security configuration requirements. The program also helps provide the CIO with an additional level of assurance by identifying known security vulnerabilities within State systems and applications. However, Defense, Homeland Security, and Justice reported inconsistent implementation of common secure configuration policies across departmental systems. Without consistent implementation of common security configurations across systems, these departments increase the risk that their systems will have avoidable security vulnerabilities. FISMA mandates that all federal employees and contractors who use department information systems be provided with periodic training in information security awareness and accepted information security practices. FISMA also requires agencies to provide appropriate training on information security to personnel who have significant security responsibilities. This training, described in NIST guidance, should inform personnel, including contractors and other users of information systems supporting the operations and assets of an agency, of information security risks associated with their activities and of the roles and responsibilities of personnel to properly and effectively implement the controls required by policies and procedures that are designed to reduce these risks. Although the four departments reported that they have implemented training for the majority of their personnel, three departments face individual challenges, as follows: Defense officials reported that the department’s components have not been able to document and track whether their 2.3 million users (who are distributed worldwide) have received the required awareness training. For example, the Department of the Army is currently unable to ensure that users who access its IT systems have taken the required awareness training. To overcome this obstacle, the Army has identified a need for a componentwide tool that will ensure that only users who have taken the required training are permitted to access its systems. In addition, Defense officials stated that several of its components have difficulty in identifying and tracking all employees who have significant IT security responsibilities. For example, U.S. Air Force officials stated that it is challenging to identify these personnel when they are not within an IT functional area, and the Defense Information Systems Agency stated that it is difficult to track information security training requirements for contractors because of the lack of a central personnel database. In fiscal year 2006, Defense issued a training and workforce improvement manual to provide instructions to components to account for and track training of all IT security personnel, even in the absence of a central personnel database. Such a manual, if properly implemented, could help Defense ensure that all personnel receive appropriate security training. However, until Defense implements a mechanism to track training of personnel, it will be unable to verify that personnel are effectively trained in their information security roles and responsibilities. Homeland Security has not been able to ensure that employees who have significant IT security responsibilities receive specialized training. Specifically, the Homeland Security IG reported that the department has not yet established a program to train all individuals who have significant IT security responsibilities. Furthermore, in fiscal year 2006, the IG reported that Homeland Security did not ensure that employees with these responsibilities had completed the required training in the department’s process for validating the annual FISMA metrics. In addition, the department reported that it was unable to accurately report on the percentage of employees who have received specialized training because its reporting tool counts each course taken, instead of tracking that an individual has taken a specialized course. As a result, it could not be assured that all users had completed required training. Homeland Security has efforts under way to implement a centralized Web-based learning management system that will track the completion of security training. Until such a system is properly implemented, the department is unable to identify personnel who have not completed required training. State has not been able to verify that all employees and contractors have received required annual awareness training. The State IG reported that the department was unable to determine the total number of users who are required to complete the annual awareness training because of duplicate entries in State’s database that generates the number of users. Without adequate controls to ensure the accuracy of training information, the department cannot confirm that all personnel who require awareness training have actually completed the training. FISMA requires that department information security programs include periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices. This testing is to be performed with a frequency that depends on risk, but no less than annually. It is to include testing of management, operational, and technical controls for every information system identified in the FISMA-required inventory of major systems. Furthermore, a review of each system is essential to determine the program’s effectiveness. However, as we explained in a prior report, the depth and breadth of such system reviews are flexible and depend on several factors, such as (1) the potential risk and magnitude of harm to the system or data, (2) the relative comprehensiveness of the last year’s review, and (3) the adequacy and successful implementation of the plan of action and milestones for weaknesses in the system. Each of the four departments reported progress in increasing the percentage of systems for which reviews were performed and security controls tested (see fig. 1). However, the departments have not demonstrated adequate and effective monitoring and evaluation of information security controls. In previous work, we showed that guidance for performing such assessments at these departments was not sufficient, and that the departments have not adequately and effectively implemented policies for periodically testing and evaluating information security controls. We reported that the policies for the 24 Chief Financial Officer’s Act agencies for periodically testing and evaluating security controls did not fully address elements included in OMB and NIST guidelines and standards for performing effective security testing and evaluations. In particular, we reported that Defense, Homeland Security, Justice, and State had not established adequate instructions for determining the depth and breadth of periodic tests. Table 3 indicates weaknesses in developing and promulgating documented policies to address the security elements needed for effective testing. Ensuring that departmental policies are sufficient to address federal standards and guidelines helps to ensure their effective implementation in meeting FISMA requirements for testing and evaluation. Until these departments address the weaknesses in their policies, departments may not be able to overcome the weaknesses in the corresponding security control activities required by FISMA. In addition, the departments reported that security control testing was not performed consistently across all components in three of the four departments. Justice was the only department to report that all of its components successfully completed the required annual security control and contingency plan testing on all their systems. This success was achieved through the department’s efforts to establish and maintain a system inventory and to manage departmentwide risks. In contrast, Defense, Homeland Security, and State reported inconsistent testing of security controls and contingency plans among their components. As shown in tables 4 to 6, components of Defense, Homeland Security, and State reported widely varying percentages of systems tested. For example, at Homeland Security, the percentages for contingency plan testing ranged from 39 to 97 percent. Without consistent security testing across all components, a department lacks assurance that it is maintaining adequate information security departmentwide. In addition to periodically evaluating the effectiveness of security policies and controls, acting to address any identified weaknesses is a fundamental activity that allows an organization to manage its information security risks cost-effectively, rather than reacting to individual problems only after a violation has been detected or an audit finding has been reported. FISMA directs agencies to establish a process for remediating identified weaknesses in their information security policies and procedures. When weaknesses are identified, agencies are required to follow OMB and NIST guidance for developing and maintaining a plan of action and milestones. NIST Special Publication 800-37 states that remediation plans need to be updated to address weaknesses identified as a result of periodic testing. Key to an effective remediation plan is the accurate and complete inclusion of weaknesses identified during periodic testing. Remediation plans (also referred to as plans of action and milestones) should list all identified weaknesses and show estimated resource needs or other challenges to resolving them, key milestones and completion dates, and the status of corrective actions. In their fiscal year 2006 FISMA reports, the IGs at all four departments reported that the departments did not consistently use the remediation plan process to manage the correction of their information security actions. Specifically, the four departments had not fully ensured (1) that significant IT security weaknesses are addressed in a timely manner and receive appropriate resources or (2) that when an IT security weakness is identified, program officials develop, implement, and manage plans of action and milestones for their systems. Table 7 lists the challenges identified by the four departments and IGs regarding why they struggle to effectively handle deficiencies in information security policies, procedures, and practices. Although the four departments have control monitoring and weakness remediation processes in place, each department faces barriers to effectively incorporating these processes into their departmentwide information security programs: Defense officials reported that the size of the department has made it difficult to overcome its challenges in developing remediation plans. However, Defense is in the process of developing a departmentwide remediation process, but the process has not been completed and promulgated in final form. Interim guidance has been issued, and the Defense CIO stated that more time is needed to coordinate staffing to complete the final remediation guidance. Without complete guidance and an established departmentwide process, Defense cannot be assured that identified security weaknesses have been tracked and corrected. At Homeland Security, component agencies view the departmentwide FISMA reporting tool as more of a hindrance than a help for tracking their weaknesses, so use of the tool is inconsistent across component agencies. However, the department headquarters disagrees with the components on the usefulness of the tool. Unless the department can achieve user acceptance of this tool, it will be challenged to establish a consistent departmentwide remediation process. At Justice, the transition from an earlier NIST control framework to that in the most recent guidance resulted in duplicate versions of plans of action and milestones (one for each framework). According to Justice officials, the department’s tool for tracking these plans does not permit easy reconciliation of these redundancies because there is no automated process in place to do so. As a result, the department is challenged in accurately tracking information security weaknesses. Without such accurate tracking, the department has little assurance that security weaknesses are being addressed appropriately. In September 2006, State’s IG stated that the department has not yet verified that IT security findings and recommendations from external and internal reviews are being addressed and resolved as part of the remediation process. The department is aware of the need to have all data in its tracking tool—including weaknesses reportable via the remediation process—monitored and validated on a regular basis. To address this issue in fiscal year 2007, the senior agency information security officer plans to use a “system vulnerability checklist” to ensure that system owners are aware of the weaknesses and plan to remediate them in a timely manner according to the set milestones. If properly implemented, such a process could help to ensure that identified security weaknesses have been tracked and corrected. OMB has established a certification and accreditation process for federal agencies that supports the establishment of the information security programs required by FISMA. This process requires various activities, including assessing system risk, documenting security controls in place and planned, testing controls in place, and analyzing test results. Such a process provides a basis on which a senior agency official decides whether or not to approve system operation. Requiring such approvals from senior officials helps to ensure that risk is considered in the context of departmentwide mission operations. However, as seen in table 8, three of the four departments reported that not all systems in their inventory are fully certified and accredited, and two of the four departments’ IGs rated their respective department’s certification and accreditation process as “poor.” Only Justice overcame its challenges of prior years and achieved success in this activity. According to Defense officials, the reason for the low percentage reported is that many of these systems received interim authority to operate, which is not reflected in the reported numbers. Defense considers such interim authorities appropriate for certain systems, such as legacy systems and battlefield systems. However, systems without a full authorization to operate are an increased risk to agencywide operations, contributing to the overall risk to the agency. In fiscal years 2005 and 2006, the Homeland Security IG reported that the data contained in the department’s tracking tool used for monitoring the certification and accreditation process were often either incomplete or insufficient. In addition, in Homeland Security’s effort to produce complete certification and accreditation documentation to satisfy federal requirements, the department’s IG judged that the quality of work performed and documented did not meet applicable criteria. The IG has made recommendations to improve the quality of all certification and accreditation documents. In September 2006, the State IG reported that the department’s bureaus performed certification and accreditation of their respective systems, and that two components (Information Resource Management and Diplomatic Security) also performed certification and accreditation on both applications and systems. The IG believed that the certification and accreditation process was fragmented and did not enable the department to adequately verify that all potential vulnerabilities are being addressed. The IG recommended that the CIO assign one entity the responsibility to manage the certification and accreditation process. Accordingly, the department now has an effort under way to address the inconsistencies in its certification and accreditation process, which has received positive feedback from internal stakeholders. Although we have not evaluated the new process, if it is implemented consistently across the department, it could reduce potential risks to the department’s information systems. Defense, Homeland Security, Justice, and State face challenges in implementing key information security control activities required by FISMA and OMB, which include maintaining complete and accurate system inventories, implementing common security configurations for all system platforms, training personnel, establishing and consistently implementing complete policies and processes for testing security controls, and fully certifying and accrediting information systems. The challenges in implementing these requirements arose from various weaknesses, including inadequate tools and gaps or inconsistencies in guidance. These departments recognize the need to improve their implementation processes and have begun various steps to do so. For example, State is addressing the inconsistencies with its certification and accreditation process, and Defense is in the process of developing a departmentwide remediation process. Until each department improves its performance of key FISMA activities, the likelihood of fully implementing an effective information security program is diminished. To assist the Departments of Defense, Homeland Security, Justice, and State in addressing challenges to implementing FISMA requirements, we are making the following 15 recommendations. We recommend that the Secretary of Defense direct the Department of Defense’s CIO to take the following six actions: Develop and implement a plan with milestones to finalize and implement a departmentwide definition of a major information system that is accepted by the Defense IG. Develop and implement a plan with milestones to achieve full implementation of common security configurations across all system platforms. Develop and implement a plan with milestones to implement a mechanism to track information security training of personnel (i.e., security awareness and specialized training). Address the weaknesses in security control testing policies as described in this report, and ensure that components complete required annual security control and contingency plan testing on all systems. Complete development of the departmentwide remediation process and finalize the remediation guidance. Develop and implement a plan with milestones to ensure that all information systems receive a full authorization to operate, and to improve the department’s certification and accreditation process. We recommend that the Secretary of Homeland Security direct the Department of Homeland Security’s CIO to take the following four actions: Develop and implement a plan with milestones to achieve full implementation of common security configurations across all system platforms. Coordinate with Homeland Security’s Office of Human Capital to finalize implementation of the centralized Web-based learning management system for tracking the information security training of personnel. Address the weaknesses in security control testing policies as described in this report, and ensure that components complete required annual security control and contingency plan testing on all systems. Determine whether the department’s FISMA reporting tool meets the requirements of different users, such as those at components, and take any necessary corrective action. We recommend that the Attorney General direct the Department of Justice’s CIO to take the following three actions: Develop and implement a plan with milestones to achieve full implementation of common security configurations across all system platforms. Address the weaknesses in security control testing policies as described in this report. Reconcile redundancies in the department’s remediation plan tracking tool. Finally, we recommend that the Secretary of State direct State’s CIO to take the following two actions: Improve mechanisms for tracking information security awareness training of personnel. Address the weaknesses in security control testing policies as described in this report, and ensure that components complete required annual security control and contingency plan testing on all systems. We received written comments on a draft of this report from Defense’s Deputy Assistant Secretary of Defense Information and Identity Assurance (reproduced in app. II), from the Director of Homeland Security’s Departmental GAO/OIG Liaison Office (reproduced in app. III), from Justice’s Assistant Attorney General for Administration (reproduced in app. IV), and from State’s Assistant Secretary for Resource Management and Chief Financial Officer (reproduced in app. V). In these comments, officials from Homeland Security, Justice, and State generally agreed with our recommendations to their respective departments, and stated that they had implemented or were in the process of implementing them. Defense generally agreed with two recommendations, partially agreed with a third, and did not agree with the other three. All four departments provided technical comments, which we have incorporated as appropriate. In its comments, Defense did not concur with our recommendation to develop and implement a departmentwide definition of a major information system that is accepted by the Defense IG. Defense stated that it has a standard definition for FISMA reporting and has informed the Defense IG that it will continue to use the definition in the annual data call. While Defense does have a definition of a major information system specified in its annual IT repository guidance, as we discuss in our report, Defense’s own guidance provides at least two definitions of a system. This forces the components, and the Defense IG, to make independent interpretations of what should be included in the inventory for FISMA reporting purposes, leading to inconsistent results. Thus, we continue to believe our recommendation has merit. Defense partially concurred with our recommendation to achieve full implementation of common security configurations across all system platforms, noting that it was spearheading a federal initiative and that the policy is planned for implementation by February 2008. Defense concurred in principle with our recommendation to implement a mechanism to track information security training of personnel and stated that the department has already initiated actions to complete the recommendation. Defense also concurred in principle with our recommendation to address the weaknesses in security control testing policies and ensure that components complete required security control and contingency plan testing for all systems. Defense did not concur with our recommendation to complete the development of the departmentwide remediation process and finalize the remediation guidance. However, officials commented that the interim guidance, discussed in our report, will be finalized in September 2007. Defense also did not concur with our recommendation to ensure that all information systems receive a full authorization to operate and to improve the department’s certification and accreditation process. Defense stated that it believes an interim authorization to operate represents a sound risk management practice and balances operational requirements with acceptable risk, while further noting that its combined interim and full authorizations to operate total 91.9 percent of Defense systems. Although interim authorizations to operate represent some level of accepting risk, we believe that without a full authorization to operate, there is an increased risk to the department’s operations and continue to believe our recommendation has merit. In addition, Defense stated that the report does not accurately reflect the current security posture of the department and the progress it has made in implementing the provisions of FISMA. Throughout our report, where appropriate, we acknowledge the progress made by the department in implementing the provisions of FISMA and have deleted certain outdated information contained in the draft report. Nonetheless, Defense still faces challenges in individual areas of FISMA as noted in our report. In its comments, Homeland Security noted that the report does not provide common solutions that could be applied to large agencies across the federal government. Our review was not governmentwide in scope; rather, it was limited to challenges faced by Defense, Homeland Security, Justice, and State. Accordingly, our recommendations are addressed individually to these four departments. State also provided several comments related to the contents of our report. First, the department did not agree with the report’s implication that the issues associated with the recommendations serve as challenges or obstacles that inhibit the implementation of FISMA. Rather, State characterizes them as weaknesses that are receiving the proper attention. We believe that the issues identified in our report are appropriately characterized as the challenges State faces with regard to verifying whether all of its employees received the required FISMA security awareness training and with regard to certifying and accrediting its systems. Our report also discusses the progress State has made in these two areas. Second, in response to the recommendation to improve mechanisms for tracking information security awareness training of all personnel, State asserted that the report declared that it is unable to identify all of its employees. However, our report does not make this claim; instead, we note that State has not been able to verify that all of its employees and contractors have received the required training. Finally, State also noted in its comments that prior GAO reports and testimonies discussed the lack of a common IG reporting framework and that current FISMA reporting does not take full account of an agency’s ability to detect, respond to, and react to cyber security threats and manage vulnerabilities. While State officials told us that these issues inhibit the department from implementing the provisions of FISMA, we emphasize that despite external factors, which may influence measurement or perception of an agency’s performance, the department still controlled the internal processes that effectively execute all of the information security program activities required by FISMA, which constituted the scope of this report. These issues were addressed, as noted by State in its comments, on a governmentwide basis in other GAO reports and testimonies that had a broader scope. As we agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from the date of this letter. At that time, we will send copies of this report to interested congressional committees; the Secretaries of Defense, Homeland Security, and State; and the U.S. Attorney General. We will also make copies available to others on request. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov. If you have any questions regarding this report, please contact me at (202) 512-6244 or by e-mail at wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix VI. Our objective was to determine the challenges or obstacles that inhibit the implementation of the information security provisions of the Federal Information Security Management Act of 2002 (FISMA) at the Departments of Defense, Homeland Security, Justice, and State. To do this, we reviewed and analyzed FISMA (Public Law 107-347) and mapped these requirements to (1) National Institute of Standards and Technology (NIST) guidelines and (2) Office of Management and Budget (OMB) reporting requirements. We also reviewed and analyzed relevant NIST special publications and federal information processing standards that were created and modified due to FISMA, as well as guidance and reports issued by OMB. For example, we reviewed and analyzed its Fiscal Year 2005 Report to Congress on Implementation of The Federal Information Security Management Act of 2002 and OMB Circular A-130, Management of Federal Information Resources. In addition, we reviewed our previous information security work. We also interviewed individuals from OMB’s Office of Information and Regulatory Affairs and Office of General Counsel and interviewed officials from the NIST Computer Security Division to discuss their FISMA implementation project work as mandated by FISMA. We also reviewed and analyzed chief information officer (CIO) and inspectors general FISMA reports for fiscal years 2003 through 2006 at Defense, Homeland Security, Justice, and State. In addition, we reviewed and analyzed various plans, policies, and procedures at the four departments. These included strategic plans, risk management policies, and budget documentation. We also held structured interviews with individuals who had FISMA implementation as their primary responsibility at each department and at selected department components. Specifically, at Defense we interviewed individuals from the Office of the Secretary of Defense as well as three Defense service components—the Departments of the Army and Navy, and the U.S. Air Force—and individuals from the Defense Information Systems Agency. At Homeland Security, we interviewed officials within the Office of the CIO as well as from the U.S. Coast Guard, Federal Emergency Management Agency, U.S. Citizenship and Immigration Services, Transportation Security Administration, and U.S. Immigration and Customs Enforcement. At Justice, we interviewed officials within the Bureau of Alcohol, Tobacco, Firearms and Explosives; the Justice Management Division; the Federal Bureau of Investigation; the Executive Office of United States Attorneys; and the Drug Enforcement Administration. At State, we interviewed officials of the Office of the Chief Information Officer, the Office of Foreign Missions, the Bureau of Diplomatic Security, and the Bureau of Information Resources Management. Finally, we met with the Office of the Inspector General at each of the four departments to discuss what challenges its department has encountered in implementing FISMA. Our work was conducted in Washington, D.C., from July 2006 through May 2007. All work was performed in accordance with generally accepted government auditing standards. In addition to the contact named above, key contributions to this report were made by Barbara Collier, Nancy DeFrancesco (Assistant Director), Neil Doherty, Timothy Eagle, Jennifer Franks, Nancy Glover, Anjalique Lawrence, Stephanie Lee, David Plocher, and Jonathan Ticehurst.

Summary: The Federal Information Security Management Act of 2002 (FISMA) strengthened security requirements by, among other things, requiring federal agencies to establish programs to provide cost-effective security for information and information systems. In overseeing FISMA implementation, the Office of Management and Budget (OMB) has established supporting processes and reporting requirements. However, 4 years into implementation of the act, agencies have not yet fully implemented key provisions. In this context, GAO determined what challenges or obstacles inhibit the implementation of the information security provisions of FISMA at the Departments of Defense, Homeland Security, Justice, and State. To do this, GAO reviewed and analyzed department policies, procedures, and reports related to department information security programs and interviewed agency officials. Defense, Homeland Security, Justice, and State face challenges in implementing key information security control activities required by FISMA and by OMB in its oversight role. These activities include creating and maintaining an inventory of major systems, implementing common security configurations, ensuring that staff receive information security training, testing and evaluating controls, taking remedial actions where deficiencies are found, and certifying and accrediting systems for operation. The four departments were challenged in several of these areas. For example, Defense is challenged in developing a complete FISMA inventory of systems because it has different definitions of what constitutes a "system." As another example, Homeland Security reported that the tool it uses to report security training counts each course taken, instead of tracking that an individual has taken a specialized course. As a result, the department lacks assurance that all users have received appropriate training. Until the departments address their challenges and fully implement effective departmentwide information security programs, increased risk exists that they will not be able to effectively protect the confidentiality, integrity, and availability of their information and information systems.