With over 235,000 employees, including physicians, nurses, counselors, statisticians, computer specialists, architects, and attorneys, VA is the second largest federal department. It carries out its mission through three agency organizations—Veterans Health Administration (VHA), Veterans Benefits Administration (VBA), and National Cemetery Administration— and field facilities throughout the United States. The department provides services and benefits through a nationwide network of 156 hospitals, 877 outpatient clinics, 136 nursing homes, 43 residential rehabilitation treatment programs, 207 readjustment counseling centers, 57 veterans’ benefits regional offices, and 122 national cemeteries. In carrying out its mission, the department depends on IT and telecommunications systems, which process and store sensitive information, including personal information on veterans. Information security is a critical consideration for any organization that depends on information systems and networks to carry out its mission or business. It is especially important for government agencies, where maintaining the public’s trust is essential. The dramatic expansion in computer interconnectivity and the expanding use of mobile devices and storage media are changing the way our government, the nation, and much of the world share information and conduct business. Without proper safeguards, enormous risk exists that systems, mobile devices, and information are exposed to potential data tampering, disruptions in critical operations, fraud, and the inappropriate disclosure of sensitive information. Recognizing the importance of securing federal systems and data, Congress passed the Federal Information Security Management Act (FISMA) in December 2002, which permanently authorized and strengthened the information security program, evaluation, and reporting requirements established by earlier legislation (commonly known as GISRA, the Government Information Security Reform Act). FISMA sets forth a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. The act requires each agency to develop, document, and implement an agencywide information security program for the data and systems that support the operations and assets of the agency, using a risk-based approach to information security management. According to FISMA, the head of each agency has responsibility for delegating to the agency chief information officer (CIO) the authority to ensure compliance with the security requirements in the act. To carry out the CIO’s responsibilities in the area, a senior agency official is to be designated chief information security officer (CISO). In June 2002, we reported that VA had not completed actions to strengthen its security management program, ensure compliance with security policies and procedures, and ensure accountability for information security throughout the department. We made four recommendations to VA: (1) complete a comprehensive security management program that included actions related to central security management functions, risk assessments, security policies and procedures, security awareness, and monitoring and evaluating computer controls; (2) develop a process for managing the department’s updated security plan to remediate identified weaknesses; (3) regularly report to the Secretary, or his designee, on progress in implementing VA’s security plan; and (4) ensure consistent use of information security performance standards when appraising the department’s senior executives. Since our report in 2002, VA’s IG has made additional recommendations addressing serious weaknesses within the department’s information security controls. In March 2005, the VA IG reported that the department had not appropriately restricted access to data, ensured that only authorized changes were made to computer programs, ensured that backup and recovery plans were adequate to ensure the continuity of essential operations, and moved the VA Central Office data center to a more appropriate location. The IG made a number of recommendations to the department to secure patient information and data over VA networks, improve application and operating system change controls, test continuity of operations plans at national data centers, and complete the move of the VA Central Office data center. In its annual FISMA report for fiscal year 2005, issued in September 2006, the IG carried forward all the recommendations from its prior years’ FISMA audits. It made recommendations in 17 areas to address all FISMA related findings for the fiscal year. On May 3, 2006, the home of a VA employee was burglarized, resulting in the theft of a personally owned laptop computer and external hard drive that contained personal information on approximately 26.5 million veterans and U.S. military personnel. The external hard drive was not encrypted or password protected. The Secretary of VA was notified of the theft on May 16, 2006, and Congress and veterans were notified on May 22, 2006. Notification letters were sent to all veterans, and VA announced that free credit monitoring services would be offered. A number of congressional hearings were held and bills introduced related to the protection of veterans’ privacy and identity. During this time period, many veteran service organizations expressed concerns to Congress as to whether VA was capable of safeguarding the personal information of veterans. These organizations also expressed doubt over whether the department’s attempts to correct the weaknesses would be effective. The stolen computer equipment was recovered on June 28, 2006, and forensic testing by the Federal Bureau of Investigation determined that the sensitive data files had not been accessed or compromised. After the equipment was recovered, the Office of Management and Budget (OMB) withdrew its request to Congress for funding for the free credit monitoring services because it had concluded that credit monitoring services were no longer necessary due to the results of the FBI’s analysis. Veterans’ organizations indicated that the department should continue to offer credit monitoring services in order to allay veterans’ worries regarding the potential of identity theft. As a result of the theft, the VA IG issued a report in July 2006 on the investigation of the incident and made five recommendations to improve VA’s policies and procedures for securing sensitive information and conducting security awareness training. Recognizing the concerns of veterans, in December 2006, Congress passed the Veterans Benefits, Health Care, and Information Technology Act of 2006. Under the act, the VA’s CIO is responsible for establishing, maintaining, and monitoring departmentwide information security policies, procedures, control techniques, training, and inspection requirements as elements of the departmental information security program. The act also includes provisions to further protect veterans and service members from the misuse of their sensitive personal information. In the event of a security incident involving personal information, VA is required to conduct a risk analysis, and on the basis of the potential for compromise of personal information, the department may provide security incident notifications, fraud alerts, credit monitoring services, and identity theft insurance. Congress is to be informed regarding security incidents involving the loss of personal information. On January 22, 2007, a security incident at a research facility in Birmingham, Alabama, highlighted other potential risks associated with the loss of information. The incident involved the loss of information on 1.3 million medical providers from the Centers for Medicare & Medicaid Services of the Department of Health and Human Services, as well as information on 535,000 individuals. In its report on the Birmingham incident, the VA IG noted that the information compromised in the incident could potentially be used to compromise the identity of physicians and other health care providers and commit Medicare billing fraud. VA took action to respond to the loss of provider information by requesting the Department of Health and Human Services to conduct an independent risk analysis on the provider data loss. The risk analysis concluded that there was a high risk that the loss of personal information could result in harm to the individuals concerned, and the Centers for Medicare & Medicaid Services sent a letter to VA on March 28, 2007, requesting that credit monitoring services be offered to providers. The department mailed notification letters to providers starting on April 17, 2007, and offered credit monitoring services. In addition, the Centers for Medicare & Medicaid Services indicated that VA might need to take additional measures to mitigate any risk of further harm, but it did not specify what such action might be or specifically mention Medicare fraud. Although VA has made progress, it has not yet fully or effectively implemented two of four GAO recommendations and has not fully implemented 20 of 22 IG recommendations to strengthen its information security practices. Because these recommendations have not yet been implemented, unnecessary risk exists that personal information of veterans and others would be exposed to data tampering, fraud, and inappropriate disclosure. VA has implemented two of our recommendations. However, it has not fully implemented two other GAO recommendations. In response to our recommendation that it regularly report on progress in updating its security plan to the Secretary, the department CIO took immediate steps in 2002 to begin briefing the Secretary and Deputy Secretary on a regular basis. Regarding our recommendation that it develop a process for managing its remedial action plan, VA issued, in May 2006, its IT Directive 06-1, which established the Data Security-Assessment and Strengthening of Controls Program to remedy weaknesses in managing its action plan. It also hired a contractor to develop Web-based tools to assist department officials in managing and updating the plan on a biweekly basis. However, it has not fully implemented our remaining two recommendations. First, although it has taken action, VA has not yet fully implemented our recommendation to complete a comprehensive security management program, including actions related to central management functions, security policies and procedures, risk assessments, security awareness, and monitoring and evaluating computer controls. In August 2006, VA issued Directive 6500, which documented a framework for the department’s security management program and set forth roles and responsibilities for the Secretary, CIO, and CISO to ensure compliance with FISMA requirements. VA also developed, documented, and implemented security policies and procedures for certain central management functions and security awareness training. In addition, it implemented a process for tracking the status of security weaknesses and analyzing the results of computer security reviews using software tools the department had developed. As part of implementing the department’s security directive (Directive 6500), VA planned to issue Handbook 6500 to provide guidance for developing, documenting, and implementing the elements of the information security program. However, it has not finalized and approved this handbook, which has been in draft form since March 2005. The handbook contains the VA National Rules of Behavior, as well as key guidance for minimum mandatory security controls, performing risk assessments, updating security plans, and planning for continuity of operations. This guidance is to be used as VA undertakes these activities as part of its preparation for completing the recertification and re- accreditation of its systems by August 2008 and to comply with provisions of the Veterans Benefits, Health Care, and Information Technology Act of 2006. VA officials indicated the handbook was close to completion, but they did not provide an estimated time frame for completion. Until the handbook is finalized and approved, VA cannot be assured that department staff are consistently coordinating security functions that are critical to safeguarding its assets and sensitive information against potential data tampering, disruptions in critical operations, fraud, and the inappropriate disclosure of sensitive information. Second, VA has not fully implemented our recommendation to ensure consistent use of information security performance standards in appraising the department’s senior executives. In September 2006, VA issued a memorandum that required all senior executive performance plans, which include performance elements and expectations, to include information security as an evaluation element by November 30, 2006. According to VA, senior executive performance plans were reviewed by human resource officials, and the plans complied with the memorandum. However, VA was unable to provide documentation on the performance plan reviews or a documented process for regular review of the plans. As a result, it is unknown whether the department can appropriately hold management accountable for information security. Until VA develops, documents, and implements a process for reviewing the senior executive performance plans on a regular basis to ensure that information security is included as an evaluation element, it may not have the appropriate management accountability for information security. Although VA has implemented 2 recommendations made by the IG, it has not yet fully implemented 20 other IG recommendations. For example, in response to the IG’s recommendation that the department complete actions to relocate and consolidate the Central Office’s data center, it moved servers and network hardware to other VA locations. Regarding the recommendation to research the benefits and costs of deploying intrusion prevention systems at all sites, the department began installing intrusion prevention systems at all sites. However, the department has not completed critical management activities to implement 15 of the 17 recommendations made by the IG in September 2006, which were carried forward from its March 2005 report, to appropriately restrict access to data, networks, and VA facilities; ensure that only authorized changes and updates to computer programs are made; strengthen critical infrastructure planning to ensure information security requirements are addressed; and ensure that background investigations are conducted on all applicable employees and contractors. To begin addressing these recommendations, VA has drafted policies and procedures, implemented certain technical solutions, and relocated data center servers to new locations at VA facilities. However, according to the department’s action plan to remediate weaknesses, all actions to resolve IG recommendations will not be completed until 2009. A detailed description of the actions VA has taken or plans to take to address the IG’s 17 recommendations can be found in appendix II. VA has also made some progress in addressing the five recommendations from the IG’s July 2006 report on the investigation of the May laptop theft incident. However, it has not fully implemented corrective actions. To begin addressing these recommendations, VA has drafted policies and procedures and updated its Cyber Security Awareness training course. However, VA is still in the process of finalizing standard contracting language to ensure that contractor personnel are held to the same standards as department personnel; it is also still standardizing all IT position descriptions and ensuring that they are evaluated, have proper sensitivity level descriptions, and are consistent throughout the department. Until these actions are complete, VA has limited assurance that it has the proper safeguards in place to adequately protect its sensitive information from inadvertent or deliberate misuse, loss, or improper disclosure. The need to fully implement GAO and IG recommendations to strengthen information security practices is underscored by the prevalence of security incidents involving the unauthorized disclosure, misuse, or loss of personal information of veterans and other individuals, such as medical providers. Between December 2003 and April 2006, VA had at least 700 reported security incidents involving the loss of personal information. For example, one incident in 2003 involved the theft of a laptop containing personal information on 100 veterans from the home of a VA employee. In 2004, personal computers that contained data on 2,000 patients were stolen from a locked office in a research facility. In 2005, information on 897 providers was inappropriately disclosed over VA’s e-mail system. In addition, in 2006, employee medical records were inappropriately accessed by a VA staff member, and a hacker compromised a computer system at a medical center supporting 79,000 veterans. All these incidents were partially attributable to weaknesses in internal controls. More recently, additional incidents have occurred that, like the earlier incidents, were partially due to weaknesses in the department’s security controls. In these incidents, which include the May 2006 theft of computer equipment from an employee’s home (discussed earlier) and the theft of equipment from department facilities, millions of people had their personal information compromised. Appendix III provides details on a selection of incidents that occurred between December 2003 and January 2007. Although VA has made some progress in implementing GAO and IG recommendations to resolve these weaknesses in security controls, all actions to resolve these recommendations are not planned to be implemented until 2009. As a result, VA will be at increased risk that systems, mobile devices, and information may be exposed to potential data tampering, disruptions in critical operations, fraud, and the inappropriate disclosure of sensitive information. VA has begun or continued several major initiatives since the May 2006 security incident to strengthen information security practices and secure personal information within the department, but more remains to be done. Since October 2005, VA has been reorganizing its management structure to provide better oversight and fiscal discipline over its IT systems, and it has undertaken a series of new initiatives. However, shortcomings with the implementation of these initiatives limit their effectiveness. For example, although VA has developed a remedial action plan that includes tasks to develop, document, revise, or update a policy or program, 87 percent of these do not have an established time frame for implementation across the department. Unless such shortcomings are addressed, these initiatives may not effectively strengthen information security practices at the department. An effective IT management structure is the starting point for coordinating and communicating the continuous cycle of information security activities necessary to address current risks on an ongoing basis while providing guidance and oversight for the security of the entity as a whole. Under FISMA and the Veterans Benefits, Health Care, and Information Technology Act of 2006, the CIO ensures compliance with requirements of these laws and designates a senior agency information security officer or CISO to assist in carrying out his responsibilities. One mechanism organizations can adopt to achieve effective coordination and communication is to establish a central security management office or group to coordinate departmentwide security-related activities. To ensure that information security activities are effective across an organization, an IT management structure should also include clearly defined roles and responsibilities for all security staff and coordination of responsibilities among individual staff. The department officially began its effort to provide the CIO with greater authority over IT in October 2005 by realigning its management organization to a centralized management structure. By July 2006, a department contractor began work to assist with the realignment effort. According to VA, its goals in moving to a centralized management structure were to provide the department better oversight over the standardization, compatibility, and interoperability of IT systems, as well as better overall fiscal discipline. The Secretary approved the department’s new IT organization structure in February 2007. The new structure includes an Assistant Secretary for Information and Technology (who serves as VA’s CIO), the CIO’s Principal Deputy Assistant Secretary, and five Deputy Assistant Secretaries. Five new senior leadership positions within the Office of Information and Technology were created to assist the CIO in overseeing five core IT process areas: cyber security, portfolio management, resource management, systems development, and operations. Completion of the realignment is scheduled for July 2008. Under the new IT management structure, responsibility for information security functions within the department is divided between two core process areas: First, the Director of the Cyber Security Office (part of the Information Protection and Risk Management process area) has responsibility for developing and maintaining a departmentwide security program; overseeing and coordinating security efforts across the organization; and managing the development and implementation of department security policy, standards, guidelines, and procedures to ensure ongoing maintenance of security. The Director of Cyber Security is also the designated CISO for the department. Second, the Director of the Field Operations and Security Office (part of the Enterprise Operations and Infrastructure process area) is responsible for implementing security and privacy policies, validating compliance with certification and accreditation requirements, and managing facility information security officers. In brief, the CISO/Director of Cyber Security is thus responsible for managing the departmentwide security program, but the Director of the Field Operations and Security is responsible for implementing it. Figure 1 shows these two offices within the new management structure. Although VA has made significant progress in the realignment of its IT management structure, no documented process yet exists for the two responsible offices to coordinate with each other in managing and implementing a departmentwide security program. VA officials indicated that the Director of Cyber Security and the Director of Field Operations and Security are communicating about the implementation of security policies and procedures within the department. However, this communication is not defined as a role or responsibility for either position in the new management organization book, nor is there a documented process in place to coordinate the management and implementation of the security program, both of which are key security management practices. As a result, policies or procedures could be inconsistently implemented throughout the department. Without a consistently implemented departmentwide security program, the CISO cannot effectively ensure departmentwide compliance with FISMA. Until the process and responsibilities for coordinating the management and implementation of IT security policies and procedures throughout the department are clearly documented, VA will have limited assurance that the management and implementation of security policies and procedures are effectively coordinated and communicated. In addition, the CISO position is currently unfilled, hindering VA’s ability to strengthen information security practices and coordinate security- related activities within the department. The CISO position has been vacant since June 2006, and currently, the CIO is the acting CISO of the department. The department has been attempting to fill the position of the CISO since October 2006. In addition, the department began trying to hire staff for other senior positions in March 2007. VA officials have indicated that the process and procedures they are required to undertake to hire staff for the positions is quite extensive and takes time to complete. Nevertheless, until the position of the CISO is filled, the department’s ability to strengthen information security will continue to be hindered. Furthermore, the department’s directive on its information security program has not been updated to reflect the new IT realignment structure for the position of the CISO. Under Directive 6500, the Associate Deputy Assistant Secretary for Cyber and Information Security is the senior information security officer or CISO. However, under the new realignment structure, there is no Associate Deputy Assistant Secretary for Cyber and Information Security, and instead the Director of Cyber Security is the CISO. VA officials have said that they intend to revise the directive to reflect the new management structure, but they did not provide an estimated time frame for completion. If roles and responsibilities are not updated or consistent in VA’s policies and directives, then communication and coordination of responsibilities among the department’s security staff may not be sufficient. Action plans to remediate identified weaknesses help departments to identify, assess, prioritize, and monitor progress in correcting security weaknesses that are found in information systems. According to OMB’s revised Circular A-123, Management’s Responsibility for Internal Control, departments should take timely and effective action to correct deficiencies that they have identified through a variety of information sources. To accomplish this, remedial action plans should be developed for each deficiency, and progress should be tracked for each. Following the May 2006 security incident, VA officials began working on an action plan to strengthen information security controls at the department. Referred to as the Data Security-Assessment and Strengthening of Controls Program, the plan was developed over a period of several months, and work has been completed on some tasks. By the end of January 2007, 20 percent of the items in the action plan had been completed, and task owners had been assigned for all items in the plan. As of June 1, 2007, the plan had at least 400 items to improve security and address weaknesses that the IG has identified at the department. On a biweekly basis, the action plan is updated with status updates provided by the task owners (including the percentage of work completed to resolve the item), and a new version of the plan is created. The CIO receives a briefing on each new version of the action plan. Once the new version is approved by the CIO, the plan is made available to task owners and other officials at the department. The CIO has also briefed other senior department officials on the plan and action items. Although VA’s action plan has task owners assigned and is updated biweekly, department officials have not ensured that adequate progress has been made to resolve items in the plan. First, in more than a third of cases, VA has not completed action items by their expected completion date. Specifically, VA has extended the completion date at least once for 38 percent of the plan items, and it has extended the completion date multiple times for 6 percent of the items in the plan. The average extension was about 5 months. In addition, 28 percent of action items that remained open as of June 1, 2007, had already exceeded the scheduled completion date, and over half of the work remained to be completed for a majority of those items. These extensions and missed deadlines can be attributed in part to VA’s not developing, documenting, and implementing procedures to ensure that action items were addressed in an effective and timely manner. If weaknesses are not successfully corrected in a timely manner, VA will continue to lack effective security controls to safeguard its assets and sensitive information. Second, a large portion of VA’s approach to correcting identified weaknesses has been focused on establishing policies and procedures: 39 percent of the items in the action plan are to develop and document or revise and update a policy, a program, or criteria. However, VA has not established action items for implementing these new or changed policies and procedures across the department. For 87 percent of action items related to policies and procedures, the action plan included no corresponding task with an established time frame for departmentwide implementation. Developing and documenting policies and procedures are just the first two steps in remediating identified weaknesses. If there are no implementation tasks with time frames, VA cannot monitor and ensure successful implementation. Until VA establishes tasks with time frames to implement policies and procedures in the plan, it will not be able to successfully manage its planned actions to correct identified weaknesses. Third, VA does not have a process in place to validate the closure of action plan items, that is, to ensure both that task owners have completed the activities required to sufficiently address action items and also that there is adequate documentation of these activities. During our review, we noted the closure of approximately 80 action items that included activities such as developing a policy or procedure, creating a schedule, deploying security tools, or updating software. However, according to the department official responsible for managing the plan, upon review of these completed items, VA found a number of them lacked support for closing the item (such as documentation). This official indicated that VA was developing a process to provide validation of closed action plan items, but no supporting documentation on the development of this validation process had been provided. Until VA develops, documents, and implements a process to validate the closure of action plan items, it will not be assured that closed action items have been sufficiently addressed. Fourth, VA’s action plan does not identify the activities it is taking to address our recommendations. In November 2006, the VA official in charge of managing the plan indicated that although the department had not previously identified activities being taken to address our recommendations, it would begin to do so. However, as of June 2007, these activities had not been identified and tracked in the action plan. As a result, VA may not be able to adequately monitor its progress in implementing our recommendations to resolve identified weaknesses. Until VA identifies the activities it is taking in its action plan to address our recommendations, it will have limited assurance that progress in implementing those activities is being adequately monitored. VA has developed its Information Protection Program, which is a phased approach to ensuring that the department has the appropriate software tools to assist in ensuring the confidentiality, availability, and integrity of information. During the first phase, VA installed encryption software on laptops across the department, a task completed in September 2006. In the second phase, the department is undertaking several other information protection initiatives, including improving the security of network transmissions and the protection of removable storage devices, such as the encryption of thumb drives. These initiatives are all currently being developed and documented. One mechanism to enforce the confidentiality and integrity of critical and sensitive information is the use of encryption. Encryption transforms plain text into cipher text using a special value known as a key and a mathematical process known as an algorithm. According to VA Directive 6504, issued in June 2006, approved encryption software must be installed if an employee uses VA government-furnished equipment or other non-VA equipment in a mobile environment, such as a laptop or PDA carried out of a department office or a personal computer in an alternative worksite, and the equipment stores personal information. The encryption software used must meet Federal Information Processing Standard 140. According to department officials, by September 2006, the department had successfully encrypted over 18,000 laptops. The laptops were encrypted through a combination of two software encryption products, both of which have been certified as complying with the provisions of Federal Information Processing Standard 140. Simultaneously, VA developed and implemented routine laptop “health checks.” These checks ensure that all laptops have applied updated security policies, such as antivirus software, and will also remove any sensitive information that is not authorized to be stored on the laptop. Based on the results of our testing, VA consistently implemented encryption software at eight VA facilities, with minor exceptions. At six of the eight facilities, all laptops were encrypted in accordance with the directive. At the other two facilities, both medical centers, the directive was not implemented in a small number of cases. At one medical center, of the 58 laptops tested, 3 should have been encrypted according to VA’s policy but were not. At another medical center, of the 41 laptops tested, 1 laptop was not encrypted that should have been. In some of these cases, VHA medical center officials noted that the reference in the directive to operation in a mobile environment led to ambiguity about which laptops were required to be encrypted. Although our testing showed sound consistency in this encryption effort, this and another source of ambiguity in the directive could affect the department’s success in implementing other planned encryption initiatives. Specifically, Directive 6504 did not provide explicit guidance on whether to encrypt laptops that were categorized as medical devices, which make up a significant portion of the population of laptops at VHA facilities. At facilities for patient care, laptops could be categorized both as equipment that operated in a mobile environment (and thus subject to VA’s encryption directive) and as medical devices (and thus subject to compliance with other federal guidance that may interfere with following the encryption directive). At the two medical centers we visited, which each have over 300 laptops, most laptops were considered medical devices. When VHA officials contacted the help desk for the encryption initiative, they were told that these laptops did not need encryption software installed. However, Directive 6504 had not made this clear, increasing the challenge to VHA facilities in implementing the encryption initiative. Without guidance that takes into consideration the environment in which laptops are used in different VA facilities and that clearly identifies devices that require encryption functionality, VA may not have assurance that all facilities in the department will be able to consistently implement encryption initiatives for all appropriate devices. Finally, the department did not maintain an accurate inventory of all laptops that had been encrypted, nor did it have an inventory of all laptops within the department. Each VA facility was responsible for maintaining an inventory of laptops, including what laptops had been encrypted, but the laptop inventories at four of the eight facilities we visited were inaccurate. For example, eight laptops listed in the inventories were not laptops, but scanners, personal computers or other devices. In some cases, the inventory listed a laptop as encrypted, but testing revealed that the machine was not encrypted. (The weaknesses identified with the inventories of laptops are similar to weaknesses identified in a report we recently issued, which noted significant IT inventory control weaknesses at VA). Because it did not maintain an accurate inventory of all equipment that has encryption installed, VA may not have adequate assurance that all equipment required to be encrypted has been. As part of its phased approach to acquiring appropriate software tools, the department is undertaking several information protection initiatives. For instance, the department is working to secure network transmissions to prevent user identification, passwords, and data from being transmitted in clear text. To provide port security and device control, VA is establishing access permission lists, audit and reporting capabilities, and lists of approved devices. For the protection of removable storage media, VA developed and documented Directive 6601, which provides guidance for use of removable devices, and it is in the process of acquiring encryption software for thumb drives, external hard drives, and CD-ROM and DVD drives. VA is also acquiring encryption for mobile devices such as Blackberries. In addition, the department is establishing a public key infrastructure and Internet gateway for secure e-mail transmission and document exchange. These initiatives are in varying stages of development and have not yet been implemented. Even strong controls may not block all intrusions and misuse, but organizations can reduce the risks associated with such events if they take prompt steps to detect and respond to them before significant damage can be done. In addition, analyses of security incidents can pinpoint vulnerabilities that need to be eliminated, provide valuable input for risk assessments, help in prioritizing security improvement efforts, and be used to illustrate risks and related trends for senior management. FISMA requires that agencies develop procedures for detecting, reporting, and responding to security incidents. In addition, OMB Memo M-06-19 requires agencies to report all incidents involving personal identifiable information to the U.S. Computer Emergency Readiness Team (US-CERT) within 1 hour of discovering the incident. VA has improved its incident management capability since May 2006 by realigning and consolidating two centers with responsibilities for incident management, as well as developing and documenting key policies and procedures. Following the May 2006 security incident, VA hired a contractor to assist its Network Operations Center and Security Operations Center in developing plans for improved coordination between the two centers and for using a risk management approach to managing incidents. As part of its findings, the contractor recommended that the two centers be integrated at the regional and enterprise level. In February 2007, VA realigned and consolidated the two centers into the Network and Security Operations Center (NSOC), which is responsible for incident detection or identification, response, and reporting within the department. NSOC has also developed and documented a concept of operations for incident management and call center procedures, and it has developed a new incident report template to assist VA personnel in reporting incidents to the center within 1 hour of discovering the incident. Senior management officials also receive regular reports on security incidents within the department. In addition, VA has improved the reporting of incidents involving the loss of personal information within the department since the May 2006 incident. Following the incident, the Secretary issued a memorandum requiring all employees to take security and privacy training by June 30, 2006, as well as sign a statement of commitment and understanding regarding the handling of personal information of veterans. An analysis of reported incidents from 2003 to 2006 showed a significant increase in the reporting of incidents involving the loss of personal information to NSOC in 2006, as detailed in table 1. Of the incidents reported in 2006, 77 percent were reported after May. While the increase in reported incidents shows that the memorandum and updated security and privacy training are heightening VA employees’ awareness of their responsibility to report incidents involving loss of personal information, it also indicates that vulnerabilities remain in security controls designed to adequately safeguard information. To assist the department in improving its analysis of security incident data, NSOC merged three incident databases into one to streamline the collection of incident data gathered within the department. VA also developed a software tool with a Web-based interface (the Formal Event Review and Evaluation Tool) to analyze reported incidents and observe trends, and began using the tool in April 2007. The department has made a notable improvement in its notification of major security incidents to US-CERT, the Secretary, and Congress since the incidents in May 2006. However, the time it took to send notification letters to individuals was increased for some incidents because VA did not have adequate procedures for incident response and notification. Table 2 presents major security incidents occurring since May 2006, along with the times taken to make various notifications. As the table shows, delays in reporting incidents have generally decreased since May 2006. Coordination with other agencies. In the incident in Birmingham in January 2007, medical provider and physician information from the Centers for Medicare & Medicaid Services of the Department of Health and Human Services was lost, requiring VA to coordinate with this department to respond to the incident. At the time of the incident, VA had drafted interim procedures for incident response, including notifying individuals affected by security incidents. These draft procedures described steps to be taken to respond to incidents involving the loss of information on veterans. However, they did not include processes for coordinating incident response and mitigation activities with other agencies. This contributed to the fact that it took more time to determine the risks to medical providers, who were not notified until 85 days after the incident. To address the coordination issue, VA revised its interim procedures to indicate that incident response teams will work with other federal agencies and teams as needed to contract for independent analyses of the risk associated with compromise of the particular data involved. In March 2007, VA approved these revised interim procedures. However, the approved procedures are limited to contracting for risk analyses and do not incorporate processes for coordinating with other federal agencies on other appropriate mitigation activities. For example, although the procedures allow for the offer of credit monitoring to affected individuals, they do not address mitigating other types of risks, such as potential fraudulent claims for payment under Medicare, which were a potential risk for the Birmingham incident. Credit monitoring would not address this risk. Other coordination and mitigation activities may be needed, such as alerting the Centers for Medicare & Medicaid Services to the possibility of fraudulent claims involving specific providers to adequately address this potential risk or other risks, different from those experienced to date. Obtaining up-to-date contact information. VA’s procedures for incident response and notification do not include mechanisms for obtaining contact information on individuals (when necessary), which can also cause delays in sending out notification letters to individuals. A VA official noted that notification letters to individuals could be delayed, depending on whether the department could locate complete address information for the affected individuals and on the number of letters that must be sent. Such delays occurred in the case of the missing backup tape in May 2006 (when 159 days passed before notification letters were sent). The data and number of records that were on the backup tape were not immediately known, and the address information of veterans whose data were compromised in the incident had to be researched. Our recent report noted that agencies faced challenges in identifying address information for individuals affected by security incidents and that mechanisms should be in place to obtain contact information on individuals. However, VA’s draft and approved interim procedures do not include a mechanism for obtaining such contact information. As a result, the department’s response to incidents could be delayed when the compromised data do not include complete and accurate contact information (or there is uncertainty about the data). Risk analysis. As mentioned earlier, VA asked the Department of Health and Human Services to conduct an independent risk analysis on the provider data loss in the January 2007 incident in Birmingham; this analysis showed that there was a high risk that the loss of personal information could result in harm to the individuals concerned. Conducting such risk analyses after incidents is a recommended procedure, since appropriate incident response and notification depend on determining the level of risk associated with the particular information that is compromised. In addition, conducting periodic risk assessments before an incident occurs facilitates a rapid response, by enabling the development of mitigation activities and appropriate coordination for potential data losses. Assessments of both systems and the information they contain are important, particularly information with a high potential risk for inappropriate use or fraud. However, VA is still in the process of finalizing and approving its guidance for completing risk assessments on VA’s systems. As a result, the department does not have a current assessment of risk for the information located at its facilities and in its information systems, which could affect the coordination and mitigation activities that are developed by the department to respond to potential data losses. Until VA assesses the risk for information located at its facilities and in its information systems and uses this assessment to develop and document mitigation activities and appropriate coordination for potential data losses (particularly high-risk losses), it may not be able to adequately address potential risks associated with loss of sensitive information at its facilities and on its systems. Additional VA actions. VA has taken additional actions to improve incident response and notification. In February 2007, VA chartered the Incident Resolution Team Structure, a group of officials from organizations within the department who are responsible for responding to incidents and handling notification requirements at the national, regional, and local levels. This action was in response to an OMB memorandum issued in September 2006, which recommended that all departments and agencies develop a core management group responsible for incident response to losses of personal information, as well as a response plan for notifying individuals affected by security incidents. Roles and responsibilities within the Incident Resolution Team Structure are organized according to the level of activity, the nature of the incident, and how the incident is categorized based on risk levels. VA also uses the Formal Event Review and Evaluation Tool to determine what the risk category of a security incident should be, based on the severity of the incident. VA has also recently developed, with contractor assistance, interim regulations for security incident notification, data mining, fraud alerts, data breach analysis (that is, risk analysis of security incidents), credit monitoring, identity theft insurance, and credit protection services, as required under the Veterans Benefits, Health Care, and Information Technology Act of 2006. These interim regulations were approved by OMB and became effective on June 22, 2007. According to Standards for Internal Control in the Federal Government, internal controls at agencies should generally be designed to ensure that ongoing monitoring occurs in the course of normal operations. The methodology for evaluating an agency’s internal controls should be logical and appropriate and may include assessments using checklists or other tools, as well as a review of the control design and direct testing of the internal control. The evaluation team should develop a plan for the evaluation process to ensure a coordinated effort, analyze the results of evaluation against established criteria, and ensure that the process is properly documented. The agency should also ensure that corrective action is taken within established time frames and is followed up on to verify implementation. In an effort to promote internal controls within VA’s computer environment, VA has consolidated a number of IT compliance programs under one organization, the Office of IT Oversight and Compliance (ITOC). This office was established in January 2007. Previously, the Review and Inspection Division was responsible for conducting facility assessments and validating information entered into a database in response to VA’s annual FISMA self-assessment survey. The division was incorporated into the ITOC, which is now responsible for providing independent, objective, and quality oversight and compliance services in the areas of cyber security, records management, and privacy. It is also responsible for conducting assessments of VA’s facilities that (1) determine the adequacy of internal controls; (2) investigate compliance with laws, policies, and directives from VA and external organizations; and (3) ensure that proper safeguards are maintained. The results of these assessments are reported directly to the CIO and responsible supervisors at the facilities. The ITOC recommends corrective actions to remediate identified issues where necessary and also makes available a remediation team to assist the facility in addressing any recommendations. In January 2007, the ITOC began conducting assessments at facilities and by June 2007 had conducted 34 assessments. According to the Director of the ITOC, it recently became fully staffed with 127 personnel and will begin to conduct 12 to 18 assessments per month. VA facilities will be assessed every 3 years. Although the ITOC was formed to identify security weaknesses and ensure compliance with federal law and department policy, its approach to conducting assessments does not include basic elements necessary for evaluating and monitoring controls. For example, although the ITOC developed a checklist to conduct facility assessments, it did not develop a standard methodology for analysts to use when evaluating internal controls against the checklist, or specific criteria for each checklist item. As a result, the office lacks a process to ensure that its examination of internal controls is consistent across VA facilities. In addition, although the Director of the ITOC indicated that the assessment team recommendations to facilities are tracked in a database, no supporting documentation was provided. Further, according to the standards for internal control, organizations should follow up to ensure that corrective active is taken. However, the ITOC follows up to see if recommendations have been implemented only when a site is re-inspected. As a result, the office has no timely mechanism in place to ensure that its recommendations have been addressed. Until there are a standard methodology and established criteria for evaluating internal controls at facilities, as well as a mechanism in place to track recommendations and conduct regular follow-up on their status, VA will have limited assurance that its process for assessing its statutory and regulatory compliance and the effectiveness of its internal controls process is adequate and consistent across its facilities. Effective information security controls are critical to securing the information systems and information on which VA depends to carry out its mission. GAO and IG recommendations to address long-standing weaknesses within the department have not yet been fully implemented, nor is the implementation of the IG recommendations expected to be completed in the near future. Consequently, there is an increased risk that personal information of veterans and other individuals, such as medical providers, will be exposed to potential data tampering, disruptions in critical operations, fraud, and the inappropriate disclosure of sensitive information. Until VA addresses recommendations to resolve identified weaknesses, it will have limited assurance that it can adequately protect its systems and information. Although VA has begun or continued several initiatives to strengthen information security practices within the department, the shortcomings with the implementation of these initiatives could limit their effectiveness. If the department develops and documents processes, policies, and procedures; fills a key position and completes the implementation of major initiatives, then it will help ensure that these initiatives strengthen information security practices within the department. Sustained management commitment and oversight are vital to ensure the effective development, implementation, and monitoring of the initiatives that are being undertaken. Such involvement and oversight are critical to providing VA with a solid foundation for resolving long-standing information security weaknesses and continuously managing information security risks. To assist the department in improving its ability to protect its information and systems, we are recommending the Secretary of Veterans Affairs take the following 17 actions: Finalize and approve Handbook 6500 to provide guidance for developing, documenting, and implementing the elements of the information security program. Develop, document, and implement a process for reviewing on a regular basis the performance plans of senior executives to ensure that information security is included as an evaluation element. Develop, document, and implement a process for the Director of Field Operations and Security and Director of Cyber Security to coordinate with each other on the implementation of IT security policies and procedures throughout the department. Document clearly defined responsibilities in the organization book for the Director of Field Operations and Security and the Director of Cyber Security for coordinating the implementation of IT security policies and procedures within the department. Act expeditiously to fill the position of the Chief Information Security Officer. Revise Directive 6500 to reflect the new IT management structure and to ensure that roles and responsibilities are consistent in all VA IT directives. Develop, document, and implement procedures for the action plan to ensure that action items are addressed in an effective and timely manner. Establish tasks with time frames for implementation of policies and procedures in the action plan. Develop, document, and implement a process to validate the closure of action plan items. Include in the action plan the activities taken to address GAO recommendations. Develop, document, and implement clear guidance for identifying devices that require encryption functionality. Maintain an accurate inventory of all IT equipment that has encryption installed. Develop and document procedures that include a mechanism for obtaining contact information on individuals whose information is compromised in security incidents. Conduct an assessment of what constitutes high-risk data for the information located at VA facilities and in information systems. Develop and document a process for appropriate coordination and mitigation activities based on the assessment above. Develop, document, and implement a standard methodology and established criteria for evaluating the internal controls at facilities. Establish a mechanism to track ITOC recommendations made to facilities and conduct regular follow-up on the status of the recommendations. We received written comments on a draft of this report from the Deputy Secretary of Veterans Affairs (these are reprinted in appendix IV). The Deputy Secretary generally agreed with our findings and recommendations and stated that VA has already implemented or is working to implement all 17 recommendations. Additionally, the Deputy Secretary stated that the consolidation of all IT operations and maintenance under VA’s Chief Information Officer will enhance the department’s information security program, as well as correct long- standing deficiencies. In his comments, the Deputy Secretary also noted that the recommendation related to information security as an evaluation element in senior executive performance plans has already been implemented and that the recruitment announcement to fill the position of Chief Information Security Officer closed on July 27, 2007. He further stated that VA’s Directive 6500, issued in August 2006, remains valid. However, as mentioned in our report, Directive 6500 was not updated to reflect the new IT realignment structure that was approved by the Secretary in February 2007 and roles and responsibilities should be consistent in all department policies and directives. The Deputy Secretary also discussed some of the activities that were underway to implement our recommendations. In the draft report that was provided for comment, we indicated that VA had not implemented any of the IG’s 22 recommendations to improve information security. We have since received new information and have updated the report to reflect that VA has now implemented 2 of the 22 IG recommendations. As agreed, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we are sending copies of this report to interested congressional committees; the Secretary of Veterans Affairs; and other interested parties. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at www.gao.gov. If you have any questions regarding this report, please contact me at (202) 512-6244 or by e-mail at wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix V. Our objectives were to evaluate (1) whether the Department of Veterans Affairs (VA) has effectively addressed GAO and VA Office of Inspector General (IG) recommendations to strengthen its information security practices and (2) actions VA has taken since the May 2006 security incident to strengthen its information security practices and secure personal information. In doing this work, we analyzed relevant documentation including policies, procedures, and plans, and interviewed key department officials in Washington, D.C., to identify and assess VA’s progress in implementing recommendations and federal legislation to strengthen its information security practices. We also drew on previous GAO reports and testimonies, as well as on expert opinion provided in congressional testimony and other sources. We used certain applicable federal laws, other requirements, and guidelines, including Office of Management and Budget (OMB) memorandums, in assessing whether the Department's actions and initiatives can help ensure departmental compliance. For the first objective, we evaluated VA’s actions to address GAO and VA IG recommendations, respectively in our 2002 report and in the IG’s July 2006 and September 2006 reports. To review VA’s history of implementation efforts, we examined GAO reports, testimony from recent congressional hearings made by GAO and IG staff, as well as reports by the VA IG. To determine the implementation status of open GAO recommendations, we analyzed pertinent security policies, procedures, and plans and met with officials from VA to gather information on the department’s actions to address the recommendations. To determine the implementation status of open IG recommendations we met with officials from the VA IG Office of Audit to discuss the status of these recommendations and met with VA officials to learn what actions had been taken or were planned to take to fully address the recommendations. The VA IG concurred with the status information provided. For the second objective, we evaluated VA’s actions to strengthen its information security practices to comply with federal guidance, including recent OMB memorandums. We met with department officials to gather information on what initiatives VA had undertaken or planned to undertake to improve its information security practices. For each initiative, we obtained and analyzed supporting documentation and met with department officials responsible for the implementation of the initiatives to assess the extent to which the department had complied with federal requirements and other guidelines. In addition, we also performed audit procedures to determine the extent to which VA has installed encryption functionality on its laptop computers. Our detailed scope and methodology for the laptop encryption testing are below. Laptop Encryption Testing We examined 248 laptops at eight locations to determine whether encryption software had been installed on a selection of laptops as indicated by VA. We selected the locations to be visited based on (1) the type of facility and (2) number of facilities available to be tested in a geographic area. We identified different facility types in proximity to each other and to GAO offices. Clinics and cemeteries were excluded from the selection because the number of laptops at these locations would be quite small. We also selected a Research Enhancement Award Program location based on an incident in January 2007 involving this type of location. On the basis of the criteria listed above, we selected the following eight facilities: Baltimore Regional Office, Chicago Regional Office, Denver Health Administration Center, Denver Regional Office, Denver Research Enhancement Award Program, Hines Data Center, Hines Medical Center and the Washington, D.C., Medical Center. At each location, we obtained an inventory or population of “in use” laptops. We examined every laptop in the population that was available for review at the Baltimore Regional Office, Chicago Regional Office, Denver Research Enhancement Award Program, and the Hines Data Center because of the relatively small number of laptops in the population. We selected random samples of laptops with the intent of projecting the results to each population at the Denver Health Administration Center, Denver Regional Office, Hines Medical Center, and Washington, D.C., Medical Center. We conducted testing of encryption implementation on laptops at select VA facilities to determine whether the department’s laptops were in compliance with VA Directive 6504 which stated that if a laptop was in a mobile environment and contained sensitive information that it be encrypted using approved software that is validated against National Institute of Standards and Technology standards. We also tested laptops at the two medical facilities to see whether the laptops should be encrypted according to the facility inventory because multiple inventories were received from these locations. In addition, we tested the laptops at the two medical facilities to see whether the laptop was considered a medical device based on the definition of medical devices provided to us by VA. At each location there were a small number of laptops that were unavailable to us to be tested. Department officials cited several reasons for this, including that the laptop had been turned in to be disposed of or discarded according to VA policy, had a hard drive failure, or could not be brought in to the site for testing. In table 3, the “laptops tested” column represents the number of laptops the team was able to test. For all four locations where every laptop in the population was tested, we used the results of our test to determine whether the directive had been consistently implemented. For the Denver Health Administration Center and the Denver Regional Office, our sample results allowed us to estimate with 95 percent confidence that at least 93 percent of the laptops would have consistently implemented the directive. On the basis of these results, we concluded that at these six sites, VA had consistently implemented its directive. For the Hines Medical Center and the Washington, D.C., Medical Center, the results of our tests indicated that VA’s directive had not been consistently implemented for one laptop and three laptops at these facilities respectively. We performed our work at VA headquarters in Washington, D.C., and at the selected VA facilities listed above, in accordance with generally accepted government auditing standards, from November 2006 through August 2007. This appendix includes the actions the Department of Veterans Affairs (VA) has taken or is planning to take to address 17 recommendations related to Federal Information Security Management Act related findings made by the VA Office of Inspector General (IG) as reported to us by the completion of our review in August 2007. The Department of Veterans Affairs (VA) had at least 1500 security incidents reported between December 2003 and January 2007 which included the loss of personal information. Below is additional information on a selection of incidents, including all publicly reported incidents subsequent to May 3, 2006, that were reported to the department during this period and what actions it took to respond to these incidents. These incidents were selected from data obtained from VA to provide illustrative examples of the incidents that occurred at the department during this period. December 9, 2003: stolen hard drive with data on 100 appellants. A VA laptop computer with benefit information on 100 appellants was stolen from the home of an employee working at home. As a result, the agency office was going to recall all laptop computers and have encryption software installed by December 23, 2003. November 24, 2004: unintended disclosure of personal information. A public drive on a VA e-mail system permitted entry to folders/files containing veterans’ personal information (names, Social Security numbers, dates of birth, and in some cases personal health information such as surgery schedules, diagnosis, status, etc.) by all users after computer system changes made. All folders were restricted, and individual services were contacted to set up limited access lists. December 6, 2004: two personal computers containing data on 2,000 patients stolen. Two desktop personal computers were stolen from a locked office in a research office of a medical center. One of the computers had files containing names, Social Security numbers, next of kin, addresses, and phone numbers of approximately 2,000 patients. The computers were password protected by the standard VA password system. The medical center immediately contacted the agency Privacy Officer for guidance. Letters were mailed to all research subjects informing them of the computer theft and potential for identity theft. VA enclosed letters addressed to three major credit agencies and postage paid envelopes. This incident was reported to VA and federal incident offices. March 4, 2005: list of 897 providers’ Social Security numbers sent via e-mail. An individual reported e-mailing a list of 897 providers’ names and Social Security numbers to a new transcription company. This was immediately reported, and the supervisor called the transcription company and spoke with the owner and requested that the file be destroyed immediately. Notification letters were sent out to all 897 providers. Disciplinary action was taken against the employee. October 14, 2005: personal computer containing data on 421 patients stolen. A personal computer that contained information on 421 patients was stolen from a medical center. The information on the computer included patients’ names; the last four digits of their Social Security numbers; and their height, weight, allergies, medications, recent lab results, and diagnoses. The agency’s Privacy Officer and medical center information security officer were notified. The use of credit monitoring was investigated, and it was determined that because the entire Social Security number was not listed, it would not be necessary to use these services at the time. February 2, 2006: inappropriate access of VA staff medical records. A VA staff member accessed several coworkers’ medical records to find date of birth. Employee information was compromised and several records were accessed on more than one occasion. No resolution recorded. April 11, 2006: suspected hacker compromised systems with employee’s assistance. A former VA employee is suspected of hacking into a medical center computer system with the assistance of a current employee providing rotating administrator passwords. All systems in the medical center serving 79,000 veterans were compromised. May 5, 2006: missing backup tape with sensitive information on 7,052 individuals. An office determined it was missing a backup tape containing sensitive information. On June 29, 2006, it was reported that approximately 7,052 veterans were affected by the incident. On October 11, 2006, notification letters were mailed, and 5,000 veterans received credit protection and data breach analysis for 2 years. August 3, 2006: desktop computer with approximately 18,000 patient financial records stolen. A desktop computer was stolen from a secured area at a contractor facility in Virginia that processes financial accounts for VA. The desktop computer was not encrypted. Notification letters were mailed and credit monitoring services offered. September 6, 2006: laptop with patient information on an unknown number of individuals stolen. A laptop attached to a medical device at a VA medical center was stolen. It contained patient information on an unknown number of individuals. Notification letters and credit protection services were offered to 1,575 patients. January 22, 2007: external hard drive with 535,000 individual records and 1.3 million non-VA physician provider records missing or stolen. An external hard drive used to store research data with 535,000 individual records and 1.3 million non-VA physician provider records was discovered missing or stolen from a research facility in Birmingham, Alabama. Notification letters were sent to veterans and providers, and credit monitoring services were offered to those individuals whose records contained personally identifiable information. In addition to the individual named above, key contributions to this report were made by Charles Vrabel (Assistant Director), James Ashley, Mark Canter, Barbara Collier, Mary Hatcher, Valerie Hopkins, Leena Mathew, Jeanne Sung, and Amos Tevelow.

Summary: In May 2006, the Department of Veterans Affairs (VA) announced that computer equipment containing personal information on approximately 26.5 million veterans and active duty military personnel had been stolen. Given the importance of information technology (IT) to VA's mission, effective information security controls are critical to maintaining public and veteran confidence in its ability to protect sensitive information. GAO was asked to evaluate (1) whether VA has effectively addressed GAO and VA Office of Inspector General (IG) information security recommendations and (2) actions VA has taken since May 2006 to strengthen its information security practices and secure personal information. To do this, GAO examined security policies and action plans, interviewed pertinent department officials, and conducted testing of encryption software at select VA facilities. Although VA has made progress, it has not yet fully implemented most of the key GAO and IG recommendations to strengthen its information security practices. Specifically, VA has implemented two GAO recommendations: to develop a process for managing its plan to correct identified weaknesses and to regularly report on progress in updating its security plan to the Secretary. However, it has not fully implemented two other GAO recommendations: to complete a comprehensive security management program and to ensure consistent use of information security performance standards for appraising senior VA executives. In addition, the department has not yet fully implemented 20 of 22 recommendations made by the IG in 2006. For example, VA has not completed activities to appropriately restrict access to data, networks, and department facilities; ensure that only authorized changes and updates to computer programs are made; and strengthen critical infrastructure planning. Because these recommendations have not yet been implemented, unnecessary risk exists that the personal information of veterans and others, such as medical providers, will be exposed to data tampering, fraud, and inappropriate disclosure. Since the May 2006 security incident, VA has continued or begun several major initiatives to strengthen its information security practices and secure personal information within the department, but more remains to be done. These initiatives include continuing efforts begun in October 2005 to reorganize its management structure to provide better oversight and fiscal discipline over its IT systems; developing an action plan to correct identified weaknesses; establishing an information protection program; improving its incident management capability; and establishing an office responsible for oversight of IT within the department. However, implementation shortcomings limit the effectiveness of these initiatives. For example, no documented process exists between the Director of Field Operations and Security and the chief information security officer (CISO) to ensure the effective coordination and implementation of security policies and procedures within the department. In addition, the position of the CISO has been unfilled since June 2006. Although, 39 percent of items in the department's remedial action plan are tasks to develop, document, revise, or update a policy or program, 87 percent of these items have no corresponding task with an established time frame for implementation across the department. VA also did not have clear guidance for identifying devices that require encryption functionality, and it lacked adequate procedures for incident response and notification. Finally, VA's Office of IT Oversight and Compliance lacks a standard methodology and established criteria to ensure that its examination of internal controls is consistent across VA facilities. Until the department addresses recommendations to resolve identified weaknesses and implements the major initiatives it has undertaken, it will have limited assurance that it can protect its systems and information from the unauthorized disclosure, misuse, or loss of personal information of veterans and other personnel.