Established by the Communications Act of 1934, FCC regulates interstate and international communications by radio, television, wire, satellite, and cable. It is responsible for, among other things, making available rapid, efficient, nationwide, and worldwide wire and radio communication services at reasonable charges and on a nondiscriminatory basis, and more recently, promoting competition and reducing regulation of the telecommunications industry in order to secure lower prices and higher quality services for consumers. FCC is charged with carrying out various activities, including issuing licenses for broadcast television and radio; overseeing licensing, enforcement, and regulatory functions of carriers of cellular phones and other personal communication services; regulating the use of radio spectrum and conducting auctions of licenses for spectrum; investigating complaints and taking enforcement actions if it finds that there have been violations of the various communications laws and commission rules that are designed to protect consumers; addressing public safety, homeland security, emergency management, and preparedness; educating and informing consumers about communications goods and services; and reviewing mergers of companies holding FCC-issued licenses. FCC’s basic structure is prescribed by statute. It is composed of five commissioners, appointed by the President with the advice and consent of the Senate to serve 5-year terms. No more than three commissioners The President designates one of may come from any one political party.the commissioners as chairman. The chairman derives authority from the provisions of the Communications Act and FCC rules which define the chairman’s duties to include, among other things, presiding at all meetings and sessions of the commission, representing the commission in all matters relating to legislation and before other government offices, and generally organizing and coordinating the work of the commission. The commissioners delegate many of FCC’s day-to-day responsibilities to the commission’s 7 bureaus and 10 offices. The chairman also delegates management and administrative responsibilities, including IT, to FCC’s Office of the Managing Director. The FCC relies extensively on computerized systems to support its mission-related operations in addition to information security controls to protect agency data. The use of IT to implement the commission’s business operations is performed by FCC’s Information Technology Center which is organizationally placed within the Office of the Managing Director. Through its computer network and systems, the FCC collects and maintains non-public information, including proprietary information of businesses regulated by the commission. In an effort to meet federal information security requirements and address implementing guidance, the Managing Director established a cybersecurity program and delegated key information security responsibilities to the commission’s Chief Information Officer (CIO). The CIO is responsible for, among other things: overseeing the development and maintenance of the cybersecurity program; designating and assigning responsibility to the FCC’s Chief Information Security Officer (CISO) for managing the program; coordinating with the Managing Director to ensure provision of adequate budget, staffing, and training resources required to implement the program; and evaluating and approving CISO-recommended resolution of issues related to cybersecurity. Information security is critical for any organization that depends on information systems and computer networks to carry out its mission or business. It is especially important for government agencies, such as the FCC, where maintaining the public’s trust is essential. While the use of interconnected electronic information systems allows FCC to accomplish its mission more quickly and effectively, their use also poses significant risks to the commission’s computer systems and to the critical operations they support. We have previously reported on the increasing number of cybersecurity attacks affecting federal information systems. Consistent with this, reports of security incidents from federal agencies are on the rise. Federal agencies have reported increasing numbers of security incidents that placed sensitive information at risk, with potentially serious impacts on federal operations, assets, and people. Over the past 6 years, the number of incidents reported by federal agencies to the United States Computer Emergency Readiness Teamyear 2006 to 48,563 incidents in fiscal year 2012, an increase of more than 780 percent. Accordingly, we have designated information security increased from 5,503 incidents in fiscal as a governmentwide high risk area since 1997, a designation that remains in force today. Without proper safeguards, systems are vulnerable to individuals and groups with malicious intent who can intrude and use their access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. In September 2011, the FCC discovered that it had suffered a security breach on its agency network. FCC’s actions to respond to the incident included, among other things, identifying and removing infected workstations and identifying significant factors that increased risk to its network. FCC initiated the ESN project in order to continue its response to the incident, mitigate the risk to its information resources from the malicious software, reduce the risk of a successful future attack, and address weaknesses in its security controls and network architecture. To execute this project, in November 2011, FCC requested and received approval from the Office of Management and Budget to use $10 million in previously deobligated funds and gained congressional agreement with the reprogramming plan in December 2011, contingent upon the commission providing Congress with quarterly briefings on the project’s status until completion. The ESN project includes two major efforts: (1) implementing enhanced security controls, and (2) designing and implementing a sustainable cyber threat analysis and mitigation program. Enhanced security controls. The project is intended to enhance and augment FCC’s existing security controls through changes to the network architecture and by implementing, among other things, additional intrusion detection tools, network firewalls, and audit and monitoring tools. Cyber threat analysis and mitigation. In addition to enhancing security controls, the ESN project aims to develop a sustainable cyber threat analysis and mitigation program that is to include risk management guidelines for assessing security threats and subsequent mitigation strategies. This effort is intended to provide FCC with mechanisms to analyze the criticality of commission assets, assess the likelihood that threats will endanger assets, and identify actions to reduce those risks and mitigate the consequences of an attack. In January 2012, FCC officials briefed congressional staff on its development plans for the ESN project, including, among other things, the planned schedule for acquiring and implementing new hardware and enhanced security controls and for instituting a cyber threat analysis and mitigation program in multiple phases over a 1-year period, from February 1, 2012, to January 31, 2013. The reprogrammed funds were made available for the project in February 2012, and FCC subsequently purchased equipment and engaged a prime contractor for the project in April 2012. FCC entered the project’s system development phase in April 2012, received final delivery of hardware in June 2012, and deployed the initial components of the project by the end of July 2012. This included making changes to the network architecture to enhance protection for an initial portion of the commission’s executives and their key staff. Officials stated that activities to deploy enhanced protections for all users at FCC headquarters are projected to be completed in February 2013, and that these protections will be expanded to the commission’s field offices at a later date. To protect against and detect cyber attacks, FCC also deployed a malware protection system for its network and a tool to monitor its workstations for signs of compromise. Figure 1 depicts the project timeline from the discovery of the security incident through the projected date of completion for the ESN project. FCC did not effectively implement appropriate information security controls in the initial components of the ESN project. Although the commission deployed enhanced security controls and tools for monitoring and controlling security threats as of August 2012, it had not securely configured these tools and other network devices to sufficiently protect the confidentiality, integrity, and availability of its sensitive information. These weaknesses occurred, at least in part, because FCC did not fully perform key security risk management activities during the development and deployment of the ESN project. As a result, FCC limited the effectiveness of its security enhancements and its sensitive information remained at unnecessary risk of inadvertent or deliberate misuse, improper disclosure, or destruction. A basic management objective for any organization is to protect confidentiality, integrity, and availability of the information and systems that support its critical operations and assets. Organizations accomplish this by designing and implementing access and other controls that are intended to protect information and systems from unauthorized disclosure, modification, and loss. Specific controls include, among other things, those related to system boundary protections, identification and authentication of users, authorization restrictions, cryptography, audit and monitoring procedures, and configuration management. NIST guidance recommends, among other things, that organizations should (1) control and regulate the information transmitted between interconnected systems; (2) ensure that passwords are encrypted while being stored; and (3) employ tools and techniques to monitor events on information systems, detect attacks, and provide identification of unauthorized use of systems. The initial components of the project included making changes to the network architecture to better protect the commission’s executives and their key staff. In addition, the commission deployed a malware protection system on its network and a tool to monitor its workstations for signs of compromise. However, FCC did not effectively implement or securely configure key security tools and devices to protect these users and its information against cyber attacks. For example: Certain boundary protection controls were configured in a manner that limited the effectiveness of network monitoring controls. Stored passwords were not always strongly encrypted on network devices. Although a malware protection tool had been implemented to detect and prevent cyber attacks, the tool’s capabilities for preventing certain attacks were not fully implemented. As a result of these and other deficiencies, FCC faces an unnecessary risk that individuals could gain unauthorized access to its sensitive systems and information. In addition to the above deficiencies, we identified other security weaknesses in controls related to boundary protection, identification and authentication, authorization, cryptography, audit and monitoring, and configuration management that limit the effectiveness of the security enhancements and unnecessarily place sensitive information at risk of unauthorized disclosure, modification, or exfiltration. The control weaknesses we identified during this review are described in a separate report with limited distribution. The information security weaknesses in the initial portions of the project occurred, in part, because FCC had not fully performed key information security activities during the development and deployment of these initial components. Although FCC’s life-cycle management policy integrates information security risk management activities into its life-cycle management processes—such as selecting and documenting security controls during the requirements and design life-cycle phase—it did not fully implement its policies on the ESN project. Instead, FCC deployed the initial components of the project without first fully defining security and functional requirements and without conducting required reviews of those requirements. According to NIST, the most effective method for ensuring that an organization’s protection strategy is implemented is to integrate information security into the system life cycle from inception. NIST has specified a risk management framework to guide agencies in integrating security risk management activities into agency life-cycle processes. Among other things, the framework emphasizes that agencies should (1) select security controls and document the controls in the system security plan; (2) assess the implementation of the controls to determine the extent to which they are implemented correctly, are operating as intended, and meet the security requirements; and (3) authorize the system to operate based on the results of security assessments and a determination of risk. To the commission’s credit, FCC’s life-cycle management and cybersecurity policies integrate security risk management activities into the life cycle. Specifically, FCC’s life-cycle management policy states that security controls should be selected and documented during the requirements and design life cycle phase. Additionally, it states that security controls should be implemented and assessed during the development and test life-cycle phase. Further, the cybersecurity policy states that systems should be authorized to operate, during the development and test life-cycle phase, prior to being deployed to production. Lastly, the policy states that re-authorization must occur prior to a significant change to the information system or at least every 3 years. Consistent with best practices for system acquisition,life-cycle management policy also documents dependencies among life- cycle activities. For example, it states that security and functional requirements should be developed prior to designing the system and selecting the security controls, which, in turn, should be completed prior to moving ahead with building the system and implementing the security the commission’s controls. Further, the policy calls for technical reviews, in the form of “gate” reviews, to be conducted throughout the life cycle at major transition points between key activities, such as a Requirements Approval prior to design and development activities and an In-Service Decision Approval prior to deployment, to ensure that a formal decision is made to approve the execution of further activities. Figure 2 illustrates FCC’s life- cycle management process. FCC did not fully perform key information security risk management activities called for within its own policies during the development and deployment of the initial components of the project. Specifically: Selecting and documenting security controls: At the time that the enhanced security controls were deployed in July 2012, FCC had not fully developed their security requirements. Draft requirements had been developed; however, many of them—including security requirements—lacked details or contained placeholders for more information. For example, a high-priority requirement for boundary protection contained only placeholders for information regarding the network configuration needed to implement this control. Assessing security controls: Although FCC implemented certain security tools and hardware, the commission did not effectively assess the implementation of these security controls to determine the extent to which they were implemented correctly, operating as intended, and met security requirements prior to deploying them to protect key users and commission information. Officials stated that they verified the functional configuration of user workstations and ensured that users could access network resources and local applications; however, the security controls were not specifically tested. Authorizing the system: FCC did not reauthorize the general support system to operate prior to deployment. Although FCC’s cybersecurity policy requires that systems be reauthorized prior to a significant change to the system, the FCC general support system— which includes the initial components of the ESN project—had not been reauthorized since May 2011, 14 months before the initial deployment. In deploying the initial components of the project, FCC also did not perform key life-cycle activities in accordance with the dependencies and gate reviews documented in its life-cycle policy. In particular, although FCC had planned to complete the development of security and functional requirements and hold a requirements review in June 2012, the commission proceeded with deployment without completing these activities. In a recent draft project schedule, the commission indicated that it intends to complete these activities in December 2012. Commission officials stated that they intended to conduct certain security risk management activities near the project’s projected completion. Officials further stated that FCC’s life-cycle management policy was not followed on the ESN project because the commission used an iterative life-cycle methodology to accelerate deployment of the initial components of the project. They said that an accelerated approach was necessary to protect the commission’s high-level executives from the security threat, as well as to meet the deployment timeline presented to congressional staff at the beginning of the project. While we agree that the security threat makes implementation urgent, using an iterative methodology would not negate the need to perform security risk management activities called for by federal guidelines and the commission’s policies. FCC officials further noted that its collaboration on technical activities at weekly engineering meetings with its contractors served the same purpose as gate reviews; however, the meeting minutes do not indicate that a formal decision was made to approve requirements prior to the initial deployment. Because FCC worked to meet previously committed project time frames rather than managing to a realistic schedule that integrated security risk management activities into the project life cycle—driven by inherent dependencies among activities and using gate reviews at major transition points—the commission limited the effectiveness of its security enhancements. Consequently, its sensitive information remained at unnecessary risk of inadvertent or deliberate misuse, improper disclosure, or destruction. In addition, increased risk exists that future ESN deployments may also contain security vulnerabilities and that costly and time-consuming rework may be necessary to correct deficiencies in the completed deployments. Given the significance of the ESN project to FCC’s information security, it is important that the project be managed effectively to ensure that the project succeeds in its goal of addressing weaknesses in FCC’s security controls and network architecture. Effectively managing a project entails, among other things, developing a reliable life-cycle estimate of project costs, defining and maintaining a reliable project schedule, and effectively managing project risks. Cost estimation. A reliable life-cycle cost estimate provides a structured accounting of all resources and associated cost elements required to develop, produce, deploy, and sustain a particular program, and is important to the success of government acquisition programs as it provides a basis for informed investment decision making, realistic budget formulation and program resourcing, meaningful progress measurement, proactive course correction, and accountability for results. We have reported that, among other things, a reliable cost estimate is: (1) comprehensive, meaning that it accounts for all life-cycle costs associated with a program; (2) well- documented, so that it is supported by detailed documentation of the technical baseline, which provides a common definition of technical, program, and schedule parameters; (3) accurate, in that it is regularly updated so that it always reflects the current status of the program; and (4) credible, meaning that it includes appropriate contingency reserves based on an assessment of risk and uncertainty. Project schedule. The success of a program depends, in part, on having an integrated and reliable schedule that defines, among other things, when work activities will occur, how long they will take, and how they relate to each other. A reliable schedule provides a road map for systematic execution of a program and a means by which to gauge progress, identify and address potential problems, and promote accountability. Our research has identified best practices associated with developing and maintaining a reliable schedule, including, among other things, (1) sequencing all activities, (2) integrating activities horizontally and vertically, and (3) maintaining a baseline schedule. Risk management. The discipline of risk management is important to help ensure that projects are delivered on time, within budget, and with the promised functionality. It is especially important for the ESN project, given the importance of the project to the security of FCC’s computer network and information. According to best practices for acquisition, the purpose of risk management is to identify potential issues that could endanger achievement of critical objectives before they occur. A continuous risk management approach effectively anticipates and mitigates risks that can have a critical impact on a project. Additionally, organizations that plan to acquire IT products and services for a project should identify and assess risks associated with the acquisition process. FCC has not consistently implemented these project management controls in developing and deploying the ESN project. Specifically: Reliable life-cycle cost estimate was not developed. To support its request for $10 million in reprogrammed funds, FCC developed a bill of materials that identified the equipment, software, and contractor services that officials determined would be needed to develop and deploy the ESN, along with an estimate of their costs. Although project officials reported using this bill of materials as a cost estimate for the ESN project, they have not updated it to account for the project’s full life-cycle costs. For example, it did not include costs for government employee efforts or costs associated with operating and maintaining the enhanced network. Officials reported that such costs were planned to be covered by FCC’s existing IT operating budget. SEI, CMMI® for Acquisition. However, without developing a life-cycle cost estimate that is comprehensive, FCC may not have sufficient information for program and budget decisions. For example, if the costs to implement and maintain the ESN project are not fully understood or are understated, the project is at increased risk of cost overruns and resource or funding shortfalls, potentially impacting the commission’s ability to implement the full range of security controls needed to secure sensitive data and systems at the commission. Project schedule was not sufficiently reliable. FCC did not establish a reliable schedule for the ESN project. The project schedule consisted of multiple schedules that were not always fully integrated. For example, one schedule was maintained by the prime contractor for the work it was contracted to perform, a second schedule was maintained by the project management support contractor to show a high-level view of all activities, and a third schedule was created by FCC to guide the deployment activities completed in July 2012. Taken together, these schedules were not sufficiently sequenced, were not horizontally or vertically traceable, and did not include a baseline. Specifically: Sequencing all activities. As of September 2012, only 12 percent of the activities on the prime contractor’s management schedule and 6 percent of the activities in the project management support contractor’s schedule were logically linked to predecessor or successor activities. For example, the activity for delivering finalized requirements lacked a successor activity, implying that this activity could be delayed indefinitely without impacting other project activities. This limits FCC’s ability to predict the effect on the project’s end date of, among other things, delayed activities and unrealistic deadlines. Verifying that the schedule can be traced horizontally and vertically. The separate project schedules were not integrated with one another. For example, no links existed between design activities in the prime contractor’s management schedule with the high-level view contained in the project management support contractor’s schedule. The lack of integration among these separate schedules reduces their usefulness for managing the project and the ability of different teams to work to the same schedule expectations. Maintaining a baseline schedule. The project did not have an established baseline schedule that showed baseline dates, forecasted dates, or actual progress to date for any activities to monitor and report project performance against targeted milestones. This reduces FCC’s ability to measure progress and promote accountability. Because of these weaknesses, it is difficult to know whether the project’s planned completion date is realistic. As an integrated and reliable schedule is an essential basis for managing trade-offs between cost, schedule, and scope, the absence of such a schedule increases the risk that FCC will be faced with unexpected and difficult choices about completing the project. Project risks were not fully managed. Although FCC made efforts to document and manage certain project risks, limitations existed in the commission’s management of these risks and key project risks were not taken into account. For example, although the prime contractor has begun tracking project risks, no risks had been identified before July 31, 2012, which was after deployment of the initial components of the project had begun and more than 3 months after the contractor began work. Additionally, the prime contractor did not document plans for how project risks would be addressed. Specifically, although 12 risks on the contractor’s list of project risks as of August 24, 2012, had not been accepted by FCC, none of them had contingency plans documented, including 6 high-priority risks. Also, as previously discussed, we identified problems in FCC’s management of the ESN project in several major areas, including information security risk management, requirements development and testing, project scheduling, and cost estimation; however, these problems were not identified by FCC as risks. Such weaknesses in managing project risk may limit the ability of the commission to identify and address cost, schedule, and performance shortfalls. These project management weaknesses occurred, at least in part, because FCC lacked policies and guidance for project management including for cost estimation, project scheduling, and managing project risks. Additionally, commission officials stated that FCC had lacked project management expertise. According to officials, as of November 2012, the commission had established an internal project management office to address these weaknesses. Further, they stated that this office had developed a number of standard operating procedures for various project management disciplines, although additional procedures for project management remained to be completed. Lastly, the officials stated that the office was also performing the project management functions for the ESN project, including, among other things, schedule management, cost management, and project risk management; the office also had produced a draft schedule and cost and risk documents. These are positive steps; however, until FCC updates the ESN cost estimate, finalizes a reliable schedule and fully manages project risks, it will continue to have limited ability to effectively manage and monitor the ESN project, increasing the potential that successfully mitigating the risk from cyber threats will cost more than planned and will take longer than projected. Through IT investment management, organizations define and follow a process to help senior leadership make informed decisions on competing investment options. Such investments, if managed effectively, can have a dramatic impact on an organization’s performance and accountability. If mismanaged, they can result in wasteful spending and lost opportunities for improving delivery of services. Our IT Investment Management framework states that an organization should establish the management structure needed to manage its investments and build the investment foundation by selecting and controlling individual projects. Once a project is selected, an organization should effectively oversee it throughout all phases of its life cycle. The organization should ensure that the project continues to meet mission needs at the expected levels of cost and risk as it develops and expenditures are incurred. If the project is not meeting expectations or if problems develop, the organization should quickly take steps to address the deficiencies. To its credit, FCC documented its policy for selecting, controlling, and evaluating IT investments in its Information Technology Capital Planning and Investment Control Guide. Among other things, the policy states that ongoing IT projects are to be monitored for progress against their projected cost, schedule, performance, and expected mission benefits during their planning, acquisition, deployment, and operations. All IT projects in the commission’s IT investment portfolio are to be discussed by stakeholders from across FCC on a regular basis, including project schedules and related risks or impacts that may prevent projects from meeting their target schedules. Such activities are intended to ensure that the commission’s IT initiatives are conducted in a disciplined, well- managed, and consistent manner through timely oversight, quality control, and executive review. However, FCC did not consistently conduct regular oversight of the ESN project in accordance with its investment policy. Although FCC held monthly project management review meetings where many of the commission’s IT projects were discussed by stakeholders, the ESN project was not discussed at these meetings because, according to FCC officials, only those projects under FCC’s Programming Services contract—which does not include the ESN project—were included in the project management reviews. Two oversight activities that were being performed for the ESN project include (1) periodic reviews by the CIO of a summary report of performance information on all IT projects and (2) quarterly briefings to congressional staff. However, the summary report and quarterly briefings contained limited cost, schedule, and performance data on the project. To illustrate, the quarterly congressional briefings on the status of the project were not based on measurable performance data and did not include key project activities. For example, although the August 2012 briefing slides described schedule progress as “on track,” the slides did not indicate that several activities, including requirements development, were significantly behind schedule. Officials stated that they did not update or expand the schedule section of the quarterly briefing because of the concern that doing so would increase the complexity of their presentation beyond an acceptable level. Nevertheless, without providing such information, FCC may limit the ability of congressional staff and others with oversight responsibilities to provide meaningful oversight, thus increasing the risk that the project may not meet its objectives. In response to a security breach, FCC has undertaken a variety of activities to enhance the security of its network. However, because FCC deployed the initial components of the project without performing key security risk management and life-cycle management activities called for within its own policies—such as completing security and functional requirements, conducting risk management framework steps, and performing gate reviews—it limited the effectiveness of its security enhancements and did not sufficiently protect the initial deployments from the security threats that the project is intended to mitigate. In addition, the commission’s ability to successfully achieve the objectives of the project has been hindered by weaknesses related to ESN project management and oversight activities. Although the commission reported that the project is within cost and on schedule, the lack of a reliable life cycle cost estimate and project schedule, inconsistent management of project risks, and inconsistent oversight may leave FCC management and Congress without sufficient awareness of the total life-cycle costs for developing and deploying the ESN, sufficient assurance that the commission will be able to successfully complete the project by its scheduled completion date, and adequate understanding of potential obstacles to the success of the project. These shortcomings existed, at least in part, because of a lack of FCC guidance on project management, including cost estimating, scheduling, and risk management. Unless FCC more effectively implements its IT security policies, improves its project management practices, and conducts regular oversight in accordance with commission policies, unnecessary risk exists that the ESN project may not succeed in its purpose of effectively protecting the commission’s systems and information. To help strengthen IT and project management controls over the ESN project, we recommend that the Chairman of the FCC take the following seven actions: Perform key security risk management activities for the ESN project including selecting and documenting the security controls, assessing the implementation of the controls, and authorizing the system to operate. Conduct appropriate gate reviews, such as the Requirements Approval, at major transition points in the project. Develop a life-cycle cost estimate for the ESN project that reflects current project status. Establish an integrated and reliable master schedule for the ESN project. Document, evaluate, and manage all identified project risks in a risk management process, and document mitigation strategies for all risks. Commit to a time frame for establishing commission guidance on project management, including cost estimating, scheduling, and risk management. Monitor and oversee the ESN project on a regular basis and ensure that project data used for this purpose are current and valid. In a separate report with limited distribution, we are also making 26 recommendations associated with 21 findings to resolve technical information security weaknesses related to access controls and configuration management of the ESN. In providing written comments (reprinted in app. II) on a draft of this report, the Managing Director of FCC stated that the commission largely concurred with our findings and recognized the need to maintain an effective and forward-leaning cybersecurity program, and noted that it had multiple ongoing cybersecurity initiatives dedicated to this purpose, including the ESN project. He further noted that the commission had taken steps to strengthen its IT management resources, such as forming a new project management office. The Managing Director’s comments were also accompanied by an attachment containing FCC’s responses to our seven recommendations. Within this attachment, the commission concurred with all of the recommendations and described ongoing and planned actions to address them. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 7 days from the report date. At that time, we will send copies of this report to interested congressional committees and to the Chairman of the Federal Communications Commission. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. Should you or your staffs have questions on matters discussed in this report, please contact Gregory C. Wilshusen at (202) 512-6244, Valerie C. Melvin at (202) 512-6304, or Dr. Nabajyoti Barkakati at (202) 512- 4499. We can also be reached by e-mail at wilshuseng@gao.gov, melvinv@gao.gov, and barkakatin@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. Our objectives were to assess the extent to which the Federal Communications Commission (FCC) has (1) effectively implemented appropriate information security controls for the initial components of its Enhanced Secured Network (ESN) project; and (2) implemented appropriate procedures to manage and oversee its ESN project. To determine whether FCC has effectively implemented appropriate information security controls for the initial components of its ESN project, we reviewed equipment, software, and security tools that had been deployed at the time of our review at FCC’s facility in Washington, D.C. Using National Institute of Standards and Technology (NIST) standards and guidance and FCC’s policies, procedures, practices, and standards, we evaluated controls by reviewing the complexity and expiration of password settings to determine if password management was enforced; observing methods for providing secure data transmissions across the network to determine whether sensitive data were being encrypted; assessing configuration settings to evaluate settings used to audit security-relevant events and discussing and observing monitoring efforts with FCC officials; inspecting key network devices and workstations to determine whether critical patches had been installed or were up-to-date; and examining the configurations of network- and host-based security tools to determine the extent to which they protected servers and workstations. In addition, we assessed whether FCC had established and implemented a disciplined life-cycle management approach integrated with information security on ESN by comparing FCC’s policies for system life-cycle management and cybersecurity to NIST guidance on security risk management and to widely accepted practices for system acquisition. We also compared documentation of ESN project activities and plans to these requirements and practices, and interviewed commission officials about FCC’s policies and ESN’s information security practices. To determine the extent to which FCC has implemented appropriate procedures to manage and oversee its ESN project, we evaluated FCC’s capabilities to employ the following key controls: cost estimating, scheduling, project risk management, and IT investment management. The scope and methodology for our assessment of each of these is discussed below: Cost estimating. To determine the extent to which FCC reliably estimated the costs for the ESN project, we compared the practices used in deriving the project’s cost estimate to best practices documented in the GAO Cost Estimating and Assessment Guide, which states that a reliable cost estimate is comprehensive, well- documented, accurate, and credible. As part of this, we reviewed the estimate and supporting documentation, and interviewed commission officials about the estimate and reasons for the deficiencies we identified. Scheduling. To determine the extent to which FCC developed and maintained a reliable schedule, we analyzed the project schedule as of September 2012 against the 10 best practices documented in the Exposure Draft of the GAO Schedule Assessment Guide. These include, for example, capturing all activities, integrating activities horizontally and vertically, and maintaining a baseline schedule. We also interviewed project officials about the schedule, the practices used in developing it, and reasons for deficiencies we identified. Project risk management. To assess whether FCC effectively managed the risks associated with executing the ESN project, we compared FCC’s risk management practices to best practices for system acquisition. In doing so, we reviewed the risk management plan, risk logs, and related documentation of project plans and activities. We also interviewed commission officials about these processes and the risks facing the project, as well as reasons for deficiencies we identified. IT investment management. To assess whether FCC made effective decisions about selecting the project and is providing sufficient oversight, we compared FCC’s investment management practices to statutory requirements in the Clinger Cohen Act as well as relevant sources of best practices for IT investment management. In doing this, we reviewed FCC’s policy for IT investment management and reviewed documentation such as agency e-mail discussions about the decision to invest in ESN, reports on project activities, and briefings to congressional staff. We also interviewed commission officials about the selection and oversight of the ESN project. We conducted this performance audit from May 2012 to January 2013 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the individuals named above, Gary Austin, Nick Marinos, and Christopher Warweg, Assistant Directors; Sher’rie Bacon; William Cook; Saar Dagani; Rebecca Eyler; Krzysztof Pasternak; Matthew Snyder; and Michael Stevens made key contributions to this report.

Summary: In September 2011, FCC discovered that it had experienced a security breach on its computer network, which potentially allowed sensitive information to be compromised. The commission initiated the ESN project to implement enhanced security controls and an improved network architecture to defend against cyber attacks and reduce the risk of a successful future attack. GAO was asked to assess the extent to which FCC has (1) effectively implemented appropriate information security controls for the initial components of the ESN project, and (2) implemented appropriate procedures to manage and oversee its ESN project. To do so, GAO determined the effectiveness of ESN security controls by evaluating control configurations and identifying management controls; and determined how FCC applied them to the ESN project by analyzing documentation and interviewing commission officials. The Federal Communications Commission (FCC) did not effectively implement appropriate information security controls in the initial components of the Enhanced Secured Network (ESN) project. Although FCC took steps to enhance its ability to control and monitor its network for security threats, weaknesses identified in the commission's deployment of components of the ESN project as of August 2012 resulted in unnecessary risk that sensitive information could be disclosed, modified, or obtained without authorization. This occurred, in part, because FCC did not fully implement key information security activities during the development and deployment of the initial components of the project. While FCC policy is to integrate security risk management into system life-cycle management activities, the commission instead deployed the initial components of the ESN project without, among other things, first selecting and documenting the security controls, assessing the controls, or authorizing the system to operate. As a result of these deficiencies, FCC's information remained at unnecessary risk of inadvertent or deliberate misuse, improper disclosure, or destruction. Further, addressing these deficiencies could require costly and timeconsuming rework. FCC's efforts to effectively manage the ESN project were hindered by its inconsistent implementation of procedures for estimating costs, developing and maintaining an integrated schedule, managing project risks, and conducting oversight. If not addressed, these weaknesses could pose challenges for the commission to achieve the project's goal of improved security. Specifically, FCC had not developed a reliable life cycle cost estimate for ESN that includes all implementation costs; did not, in its project schedule, adequately identify the sequence in which activities must occur, ensure that detailed activities were traceable to higherlevel activities, or establish a baseline schedule; documented and managed some risks to project success, but its prime contractor did not identify any project risks until after the deployment of the initial components of the ESN project had begun; and had not included the ESN project in its processes for conducting regular oversight of information technology projects. According to FCC officials, a key reason that they had not fully applied their policies or widely accepted best practices for security risk management and project management is because the ESN project was an emergency project and, therefore, needed to be initiated quickly. However, while GAO agrees that the security threat makes implementation urgent, it does not negate the need to perform key security risk management activities. Unless FCC more effectively implements its IT security policies and improves its project management practices and effectively applies them to the ESN project, unnecessary risk exists that the project may not succeed in its purpose of effectively protecting the commission's systems and information. GAO is making seven recommendations to the FCC to implement management controls to help ensure that ESN meets its objective of securing FCC's systems and information. In commenting on a draft of this report, FCC concurred with the recommendations. In a separate report with limited distribution, GAO is also making 26 recommendations to resolve technical information security weaknesses related to access controls and configuration management of the ESN.