The U.S. government is one of the largest users and acquirers of data, information, and supporting technology systems in the world, and plans to invest approximately $65 billion annually on IT. These investments include the acquisition of IT services and systems from thousands of contractors. The ability to contract for technology services can allow an agency to obtain or offer enhanced services without the cost of owning the required technology or maintaining the human capital required to deploy and operate it. The systems and services provided by contractors include computer and telecommunication systems and services, as well as the testing, quality control, installation, and operation of computer equipment. Additionally, contractors provide services and systems to agencies by providing IT services and systems at agency facilities; providing IT services and systems on behalf of the agency at contractor providing IT services and systems to an agency via remote access; and developing or maintaining IT systems or software. In its fiscal year 2001 report to Congress on federal government information security reform, OMB identified poor security oversight of contractor-provided IT systems and services as a common governmentwide challenge. In that report, OMB stated that IT contracts should include adequate security requirements, but that many agencies had reported no security controls in contracts or no verification that contractors fulfill any requirements that are in place. Information security is an essential component of the acquisition, development, management, and oversight of IT systems and services delivered by contractors. When relying on contractors, a federal agency transfers operational responsibilities for performing one or more IT service(s) to one or more external providers. However, the overall responsibility and accountability for securing the information and systems remains with the federal agency (see fig. 1). As depicted in figure 1, federal sources for addressing information security oversight of contractor-delivered IT systems and services are as follows FAR: emphasizes basic planning for the acquisition process; FISMA: requires an agencywide information security program that extends to contractors and other users with privileged access to federal data and systems; and NIST standards and guidance and OMB guidance: assist agencies in establishing necessary security programs. The FAR emphasizes planning and includes certain specific information security requirements and provides the primary regulation for federal executive agencies in their acquisition of IT supplies and services with appropriated funds. Additionally, in implementing federal privacy requirements, agencies are to ensure that contracts for the design, development, or operation of records systems using commercial IT services or support services include the following agency rules of conduct that the contractor and the contractor’s employees shall be required to follow; a list of the anticipated threats and hazards that the contractor must a description of the safeguards that the contractor must specifically requirements for a program of government inspection during performance of the contract that will ensure the continued efficacy and efficiency of safeguards and the discovery and countering of new threats and hazards. The FAR requires agencies to ensure that IT contracts address privacy protections in accordance with the Privacy Act. FISMA requires each agency to develop, document, and implement an agencywide information security program to protect information and information systems, including those provided or managed by another agency, contractor, or accessed by other users with privileged access to federal data. Specifically, this information security program is to include the following periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; risk-based policies and procedures that cost-effectively reduce information security risks to an acceptable level and ensure that information security is addressed throughout the life cycle of each information system; subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems; security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. Federal agencies’ implementation of FISMA requirements extends to contractors that are delivering IT systems and services and to other users of federal data and systems. In addition to these requirements, FISMA requires each agency to develop, maintain, and annually update an inventory of major information systems operated by the agency or that are under its control. This inventory is to include an identification of the interfaces between each system and all other systems or networks, including those operated by or under the control of contractors or other users with privileged access to federal data. FISMA also requires each agency to have an annual independent evaluation of its information security program and practices, including control testing and compliance assessment. Evaluations of nonnational security systems are to be performed by the agency inspector general or by an independent external auditor. Furthermore, for nonnational security systems, FISMA requires NIST to develop (1) standards to be used by all agencies to categorize all of their information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels; (2) guidelines recommending the types of information and information systems to be included in each category; and (3) minimum information security requirements for information and information systems in each category. NIST standards and guidance and OMB guidance both support agency efforts to implement FISMA. NIST has issued a number of information security standards and guidance that is intended to promote the security of federal IT systems and services, such as its guidance on conducting risk assessments and on the format and content of security plans. In addition, as part of its statutory responsibilities under FISMA, NIST has issued standards and guidance that include consideration of security oversight of contractor-provided IT systems and services and other users with privileged access to federal data and systems. In its fiscal year 2004 FISMA reporting guidance, OMB required federal agencies to use NIST SP 800-26 or an equivalent assessment tool for agency annual information security reviews. The self assessments were also to be used to evaluate the security of contractor-provided IT systems and services. The self assessments provide a method for agency officials to determine the current status of their information security programs and, where necessary, to establish a target for improvement. Federal agencies face a range of risks from contractors and other users with privileged access to federal data and systems. Contractors that provide systems and services or other users with privileged access to federal data and systems can introduce risks to agency information and systems. Most agencies recognize the contractor-related risks, including those associated with contractor software development and off-site operations. Further, agencies view users with privileged access to federal systems and data as potential sources of risk. Contractors and other users with privileged access to federal data and systems can introduce information security risks to federal information and information systems that are sometimes difficult to quantify. Examples of these risks are as follows. Strategic. Two basic strategic risks include management inexperience in overseeing contractor/other organization operations and the potential for inaccurate contractor/other organization information to negatively impact agency decisions. For example, inadequate management experience and expertise can impede an agency’s ability to understand and control key risks. Additionally, inaccurate information from a contractor/other organization may prevent the leadership of an organization from having the necessary data to make well-informed strategic decisions. Reputation. Errors, delays, system failures, or unauthorized disclosure of information may negatively impact how citizens, state and local governments, and other federal agencies view an agency and its services or mission. Legal/Compliance. Federal agencies are required to ensure that their information security programs are being applied to systems and services that are being provided by contractors/other organizations and ensure compliance with laws such as privacy protections. Implementation. Initiating a contractor relationship may require a complex transition of people, processes, hardware, software, and other assets from the agency to the provider or from one provider to another, all of which may introduce new risks. Ownership/Dependence. An agency may ignore certain security issues due to “out of sight, out of mind” thinking, having delegated this concern to the provider. An agency may also become dependent on a particular contractor. Operational. In addition to fraud or error, contractor or privileged access information security weaknesses could negatively impact agency operations, including delivering products; managing information; maintaining operations and transaction processing; customer service; systems development and support; and internal control processes. Shared Environment. Contractors may use one system to service multiple clients and, as a result, this system-sharing may pose more risks than an in- house environment. For example, sharing a common network or a processing environment, such as a general purpose server, across multiple clients can increase the likelihood of one organization having access to the sensitive information of another. The risks identified can present complex challenges to federal agencies. Many of the complexities stem from risks related to people, processes, or technologies that, if not properly overseen or managed, can potentially harm an agency’s operations, information, or systems. Most agencies (17 of 24) reported that they recognize contractor risks to their information and information systems. These people, process, and technology risks can degrade or diminish the confidentiality, integrity, and availability of agency information systems or data. Examples of agency- identified risks are summarized in table 1. In addition to the risks identified in the table, agencies identified specific risks from contractor software development activities and off-site operations. These risks include the following a poor patch management process could impact federal operations, such as agency Web sites; the hosting infrastructure may not separate customer and company the need for oversight at an off-site facility. Without proper controls, the risks associated with software development and work performed off site could be very damaging to federal information and systems. For example, loss of confidentiality, integrity, or availability of data can disrupt federal operations and services and may impede the ability to ensure the performance of mission-critical functions. Many agencies reported their risks from other users with privileged access to federal data and systems. Seventeen agencies indicated that they assess the risks posed by other users with privileged access to federal data and systems. Agency-identified risks included lack of controls on network connections; unauthorized use or release of information, such as grantee information being revealed to another grantee; malicious activity that introduces viruses and worms; and poor electronic access controls that could permit customer passwords to be compromised and exploited by identity theft. Of the remaining 7 agencies, 5 indicated that other users do not possess or use their data and systems; 1 indicated that it had not assessed risks of other users with privileged access; and the other agency did not respond regarding whether they had assessed risks of other users with privileged access to federal data and systems. Federal agencies report using three primary methods for overseeing the information security of contractors using contract language to establish information security requirements having information security policies for contractors and other users with privileged access to federal data; and using NIST self-assessment tools to assess contractor security capabilities and assess the security implemented by other users with privileged access to federal data. These methods can be leveraged for effective agency oversight of contractors and privileged users for federal systems and data. However when not properly implemented, each of these methods has limitations. Most agencies report using contract language to establish information security requirements for contractors. The FAR requires that agencies use specific contract language related to privacy or security safeguards. Table 2 contains an example of FAR-provided language for agencies to include in their IT contracts. This FAR language helps ensure that federal agencies can maintain access to contractor facilities in order to perform security oversight functions. However, this language does not address all aspects of security. For example, the clause in table 2 does not apply to subcontractors. By not including subcontractors within specific information security requirements, agencies can be introducing significant risks without a contractual tool with which to manage them. More importantly, the FAR has not been amended to reflect the requirements of the FISMA. As a result, the language in the FAR does not reflect key FISMA requirements, including periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices performed with a frequency depending on risk, but not less than annually, and including testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. The FAR provides, however, that this contract language only needs to be “substantially the same” as standard FAR clauses and agencies, therefore, have the flexibility to modify it to address FISMA requirements. Additionally, agencies are authorized to include in their agency FAR supplements, regulations, and clauses that supplement FAR policies and procedures or satisfy specific needs of the agency. Agency FAR supplements, accordingly, could include additional language to address the requirements of FISMA. However, although some agency FAR supplements include requirements related to IT security that are not in the FAR, no agency has made a comprehensive effort to revise its FAR supplement to reflect FISMA. The 2003 NIST SP 800-35 stresses the importance of establishing security requirements with external parties in formal contracts. However, by not establishing clear security requirements in contracts, agencies may not be able to ensure that their agency information is secured in accordance with FISMA. Although most agencies reported having written policies that addressed information security for contractor-provided IT services and systems and for other users with privileged access to federal data and systems, few established specific policies for overseeing the information security practices of contractors to ensure compliance with contract requirements and agency information security policies. As figure 2 illustrates, 22 of the surveyed agencies reported having information security policies for contractors, and 15 reported having policies for other users with privileged access to federal data and systems. However, the majority of agencies addressed contractors and other users with privileged access to federal information and systems within the general scope of their agency policy, and did not define information security oversight requirements. For example, agency policies did not describe oversight methods; the frequency of reviews or assessments; key management controls to mitigate unauthorized disclosure of information; physical/logical access controls; or the introduction of unauthorized features. Further, most of the agencies did not have policies or provide guidance on key areas, including control of agency data in an off-site facility or requirements for interconnection security agreements. However, we identified only 5 agencies that had established specific policies addressing contractor information security oversight. While the five agency policies reflected a broad range of maturity levels, they included many of the following elements establishing procedures for contractor information security oversight; assigning roles and responsibilities; creating specific audit plans for systems and facilities; describing interconnection security agreements; creating requirements for agency information that will be secured at contractor facilities—including storing, processing, and transmitting on contractor systems, background checks, and facility security; and requiring agency officials to conduct reviews to ensure that IT security requirements were being enforced. By establishing oversight policies that address these elements, agencies can more consistently oversee contractor security and ensure that contractors and other users with privileged access to federal systems and data comply with agency security requirements. However, without such policies, oversight efforts can be impeded. In fiscal years 2003 and 2004, many agency inspectors general cited the lack of agency policies and guidance regarding how agency program managers or organizational components should conduct oversight of contractor operations as problematic. Three different agency inspectors general reported the following Agency policies and procedures did not provide organizational components with guidance on conducting reviews of their contractor- provided services. Further, there was little evidence that components are ensuring that contractor-provided services are secure and comply with agency security policy. Agency program officials had not ensured that (1) adequate security of contractor-provided services, including not identifying the full range of services provided and that (2) oversight processes and procedures for ensuring secure operations had not been defined or implemented. Agency officials were not using adequate methods to ensure that contractor security met the requirements of FISMA, OMB, and NIST guidelines after reviewing the access controls, security clearances, and security awareness training for contractors that provide network administration, systems development, and systems administration. Without appropriate policies and guidance, agencies may not be able to effectively and efficiently assess the security of contractor operations or that of other users with privileged access to federal data and systems. For example, without specific oversight policies establishing when and how agencies will review contractor-operated systems, officials responsible for the systems may not be taking sufficient action to ensure that security requirements are being met. Further, information system controls needed to ensure secure operations may not be tested on regular intervals. As a result, agencies may not be able to protect federal information in accordance with FISMA. The majority of agencies reported using a self-assessment tool to review contractor information security, but the oversight value may be limited. NIST’s self-assessment guide states that self-assessments provide a method for agency officials to determine the current status of their information security programs and, where necessary, to establish a target for improvement. NIST SP 800-26 structures the questionnaire by management, operational, and technical controls. The section on technical controls does not require testing of those controls as part of the self-assessment, but instead relies on documentation. In response to our survey, 22 agencies reported using NIST SP 800-26 to assess contractors providing IT services and systems and 2 agencies reported not using this assessment tool. While most agencies reported using NIST SP 800-26, the self-assessment tool may have limited value in overseeing contractor information security. For example, by relying on a contractor’s self assessment, an agency official may not obtain a clear understanding of the effectiveness of security controls or be assured of the validity of the responses without independent testing. Further, the agency chief information officer or inspector general may have trouble conducting an analysis or review of the self assessment if there is not sufficient documentation. As an example of the self-assessment challenges, one agency inspector general found significant problems with the agency’s self assessment. The inspector general noted that, after reviewing a sample of the agency’s NIST SP 800-26 self assessments, (1) security weaknesses had not been properly defined, (2) variations existed between inspector general and agency scoring on the NIST SP 800-26 reviews, and (3) the agency did not verify the results of self assessments. Further, the lack of information security requirements established in contracts and the absence of agency oversight policies may diminish the efforts of reviewers using NIST SP 800-26 because they may not be able to refer to clear criteria with which to assess systems’ security. As a result, agencies may not obtain an accurate status of the security of contractor- provided systems and services. In August 2004, OMB mandated the use of NIST SP 800-26 for agency annual system reviews. However, in response to our survey, only 10 agencies reported using NIST SP 800-26 to assess other users with privileged access to federal data and systems that have connectivity to agency networks. By not assessing and testing the security controls of other users with privileged access to federal data, agencies reported that they are at increased risk of losing control of network connections, experiencing unauthorized use of information, such as grantee information being revealed to another grantee, and malicious activity that introduces viruses and worms. The administration is making efforts to improve information security over contractors, but challenges remain. For example, the information security requirements in FAR are being revised and OMB continues to gather data from the agencies about the number of contractor facilities reviewed by agencies. Additionally, NIST has issued guidance, parts of which address some contractor security issues. In response to the administration’s plans to update FAR, officials at the FAR Council stated that the acquisition regulation was being updated to address information security requirements of contractor-provided systems and services. Officials further explained that the administration had been working on updating the FAR language since 2002 when FISMA was enacted. According to the FAR Council officials, the council had completed the majority of its work in December 2004. As of March 2005, the FAR amendments were undergoing legal review. Through its FISMA reporting requirements, OMB continues to gather information about agency oversight of contractors, but understanding the effectiveness of agency efforts based on the collected data is unclear. On an annual basis, OMB collects information from the agencies about the total number of agency systems, including whether the chief information officer and the inspectors general agree on the number of systems identified and the number of contractor facilities and operations identified and reviewed using NIST SP 800-26 or an equivalent methodology. The fiscal year 2004 FISMA submissions revealed significant discrepancies in the responses from the agency and the inspector general. For example, as shown in table 3, the number of systems reported as being agency systems or contractor systems varied significantly among the chief information officers and the inspectors general at four agencies. Without a clear understanding of who has operational control of a system, agencies cannot ensure that the appropriate oversight and security controls are being implemented in accordance with agency policy. Over the past 3 years, there has been a decline in both the number of contractor facilities identified by the agencies and the number of facilities reviewed by the agencies. Figure 3 depicts this trend in 23 of the major agencies. The disagreement between agency chief information officers and inspectors general about whether systems are deemed to be agency systems or contractor systems can impede effective and efficient information security oversight efforts. In some cases, it may even result in systems not being reviewed. By not performing reviews of contractor- operated facilities, agencies cannot ensure that their information is being protected in accordance with FISMA and, as a result, federal operations and data can be at risk. The data gathered from the agencies on the number of contractor systems identified and reviewed do not provide an accurate measure of the effectiveness of agency information security oversight of contractors. However, additional data about the contracts, policies, and self assessments could provide a better measure of effectiveness. For example, asking inspectors general to determine what portion of the contractor systems identified by the agencies have specific IT security language that addresses key FISMA elements; if the agency information security policies provide specific oversight policies for contractors and privileged users of federal systems and data; and whether the required NIST SP 800-26 assessments of contractor systems were completed by the agency, the contractor, or an independent entity. Finally, annual agency reports required by FISMA do not address security related to other users with privileged access to federal data. There is not a clear governmentwide understanding of how agencies are addressing the various challenges and identified risks related to other users with privileged access. As previously discussed, agencies have not developed policies or reviewed the controls necessary to ensure that these users of federal data do not place agencies’ information and systems at risk of compromise. As a result, federal agencies that lack appropriate controls and oversight can be exposing their information and systems to additional risks from privileged users who might introduce malicious code, disclose unauthorized information, or lack controls to secure their network interfaces with the agency systems. No single federal guide exists for federal agencies to rely on when addressing information security over contractors. FISMA requirements apply to all federal contractors and organizations or sources that possess or use federal information or that operate, use, or have access to federal information systems on behalf of an agency. In support of FISMA implementation, NIST has issued a number of information security products intended to improve federal IT systems. However, in the absence of a single, comprehensive guide to assist in the development of policies, agencies must refer to portions of several different documents that address elements related to contractor information security oversight. For example, in 2005, NIST published Recommended Security Controls for Federal Information Systems, which refers to portions of the following documents that can be used by agencies to address some of the challenges related to information security oversight of contractors SP 800-18 states that agencies may require compliance with the guide as part of contract requirements; SP 800-35 lists in its appendices sample acquisition language that is appropriate for inclusion into IT security service statements of work; SP 800-47 discusses, in brief, the development of non-disclosure agreements for contractors when determining interconnection requirements; and 800-64 gives examples of contract clauses that can be used to help establish clear lines of authority and responsibility. In February 2005, NIST released the Federal Information Processing Standard 201 entitled Personal Identity Verification of Federal Employees and Contractors. This standard was developed in response to Homeland Security Presidential Directive 12 and is intended to improve the identification and authentication of federal employees and contractors for access to federal facilities and information systems. This standard helps to address the risk of contractors gaining unauthorized physical or electronic access to federal information. Unified guidance on addressing the information security oversight of contractors and privileged users of federal systems and data could assist agencies in developing effective programs to ensure compliance with agency policy. However, without clear guidance on how to develop effective information security oversight of contractors and users with privileged access to federal systems and data, federal agencies may not develop sufficient policies to address the range of risks posed by contractors and key users. As a result, federal information and operations can be placed at undue risk. Contractors provide valuable services that contribute to the efficient functioning of the government, but a range of risks from contractors and other users with privileged access to federal data and systems must be managed effectively. Contracts, policies, and security self-assessments can be leveraged as valuable oversight tools for federal agencies in managing oversight of contractors and other users. However, when not properly implemented, each of these methods has limitations. For example, many agencies are not incorporating FISMA requirements into their contract language; accordingly, their strongest tool for establishing information security requirements is limited. Additionally, many agencies have not defined specific oversight policies for contractors and other users with privileged access to federal data. Without clearly defined information security oversight policies, agencies may be accepting significant risk to their information and systems from both contractors and other users with privileged access without having the appropriate controls to mitigate the risks. Finally, agency reliance on self-assessment tools may not provide them with the appropriate tools to ensure the security of their information. To address these complex challenges, a variety of administration efforts have been started to further enhance federal agencies’ efforts to improve information security oversight of contractors, but challenges remain. For example, the effort to update FAR guidance has not been completed. In addition, continuing OMB FISMA oversight reveals challenges in contractor oversight. Finally, if agencies lack unified guidance to assist them in creating appropriate information security oversight policies for contractors and other users with privileged access to federal data and systems, federal agencies may not be able to effectively protect their information. To ensure that agencies are developing the appropriate information security oversight capabilities for contractors and other users with privileged access to federal data and systems, we recommend, in accordance with FISMA, that the Director of OMB ensure that the following two actions take place. Efforts to update FAR are completed expeditiously and that such efforts require agency security management efforts required by FISMA, including periodic testing and evaluation of management, operational, and a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies and procedures; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. Federal agencies develop policies for ensuring information security of contractors and other users with privileged access to federal data, including establishing procedures for contractor information security assigning roles and responsibilities; creating specific audit plans for systems and facilities; describing interconnection security agreements; creating requirements for agency information that will be secured at contractor facilities including storing, processing, transmitting on contractor systems, background checks, and facility security; and requiring agency officials to conduct reviews to ensure that IT security requirements are being enforced. To assist agencies in managing the risks related to contractors and other users with privileged access to federal data and systems, we recommend that the Secretary of Commerce develop a unified set of guidance for developing appropriate information security policies. We provided a draft of this report to OMB and the Department of Commerce for their official review and comment. OMB General Counsel provided oral comments on the report, which have been incorporated as appropriate. OMB generally agreed with the report findings and conclusions. OMB officials told us that, as part of the capital asset plan and business case development process, agencies are required to answer several information security oversight questions related to contractor- provided IT systems and services. These questions provide OMB important information when assessing the business case for funding. Further, OMB stated that their efforts to enhance oversight of contractors includes requiring that the 25 E-Government initiatives be independently reviewed to determine compliance with IT security requirements. OMB did not disagree with the overall recommendations and recognized the need for further agency action to address contractor security oversight. In written comments, which are reprinted in appendix II, the Deputy Secretary of the Department of Commerce acknowledged the accuracy of the report. In regard to our recommendation, Commerce stated that NIST recognizes the importance of providing guidance to assist agencies in ensuring that security requirements are applied by contractors. Additionally, NIST has developed publications that can be used for contractors and are focused on acquisition, assessments, controls, and the system development life cycle. Commerce agreed that through NIST, it would develop a strategy to build a framework for a consolidated delivery of contractor related-guidelines. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to interested congressional committees; the Director, Office of Management and Budget; and the Secretary, Department of Commerce. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or any of your staff have any questions concerning this report, please contact me at (202) 512-3317. I can also be reached by e-mail at wilshuseng@gao.gov. Other contacts and key contributors to this report are listed in appendix III. The objectives of our review were to Describe the information security risks associated with the federal government’s reliance on contractors providing information technology systems and services and other users with privileged access to federal data and systems federal information or access federal information systems. Identify methods used by federal agencies to ensure security of information and information systems that are operated, used, or accessed by contractors and other users with privileged access to federal data. Discuss what steps the administration is taking to ensure implementation and oversight of security of information and information systems that are operated, used, or accessed by contractors and other users with privileged access to federal data. To describe the information security risks associated with the federal government’s reliance on contractors and other organizations, we analyzed existing federal regulations, laws, and guidelines such as the Federal Acquisition Regulation (FAR); Federal Information Security Management Act of 2002 (FISMA); and National Institute of Standards and Technology (NIST) guidance. In addition, we interviewed federal and private-sector officials regarding the policies and procedures for overseeing contractor security. We then developed a series of questions that were incorporated into a Web-based survey instrument. We pretested our survey instrument at one federal department and one federal independent agency. We also met with Office of Management and Budget (OMB) officials to discuss OMB’s role in ensuring the security of contractor-provided systems and services. For each agency to be surveyed, we identified the office of the chief information officer, notified each office of our work, and, via e-mail, distributed a link to each office. All 24 agencies responded to our survey. We did not verify the accuracy of the agencies’ responses; however, we reviewed supporting documentation that agencies provided to validate their responses. We contacted agency officials when necessary for follow- up. Although this was not a sample survey and, therefore, there were no sampling errors, conducting any survey may introduce errors, commonly referred to as nonsampling errors. For example, difficulties in how a particular question is interpreted, in the sources of information that are available to respondents, or in how the data are entered into a database or were analyzed can introduce unwanted variability into the survey results. We took steps in the development of the survey instrument, the data collection, and the data analysis to minimize these nonsampling errors. For example, a survey specialist designed the survey instrument in collaboration with GAO staff with subject-matter expertise. Then, as previously stated, it was pretested to ensure that the questions were relevant, clearly stated, and easy to comprehend. When the data were analyzed, a second, independent analyst checked all computer programs. Because this was a Web-based survey, respondents entered their answers directly into the electronic questionnaire. This eliminated the need to have the data keyed into a database, thus removing an additional potential source of error. To identify methods used by federal agencies to ensure security of contractor-provided systems and services, we interviewed the FAR Council, OMB, and NIST officials to discuss their guidelines and other tools available to agencies. In addition, questions regarding agency policy, agency use of oversight guidelines, acquisition process, and personnel/background checks, security requirements, and contract language were included in the survey we sent to the 24 Chief Financial Officer’s Act agencies. We did not verify the accuracy of the agencies’ responses; however, we reviewed supporting documentation that agencies provided to validate their responses. We contacted agency officials when necessary for follow-up. Finally, to determine what steps the administration is taking to ensure implementation and oversight of security of contractors and other users with privileged access that operate, use, or access federal information systems on behalf of an agency, we interviewed FAR Council, OMB, and NIST officials regarding the policies and procedures for overseeing contractor security. We also reviewed annual chief information officer and inspectors general FISMA reports to assess progress made in meeting FISMA requirements related to contractor security. We conducted our work in Washington, D.C., from August 2004 through March 2005 in accordance with generally accepted government auditing standards. In addition to the individual named above, key contributors to this report included Neil Doherty, Nancy Glover, Stuart Kaufman, Anjalique Lawrence, Nnaemeka Okonkwo, and Kevin Secrest. The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to www.gao.gov and select “Subscribe to Updates.”

Summary: The federal government increasingly relies on information technology (IT) systems to provide essential services affecting the health, economy, and defense of the nation. To assist in providing these important services, the federal government relies extensively on contractors to provide IT services and systems. In addition to contractors that provide systems and services to the federal government, other organizations possess or use federal information or have access to federal information systems. These other organizations with privileged access to federal data and systems can include grantees, state and local governments, and research and educational institutions. The Office of Management and Budget (OMB) cited contractor security as a governmentwide challenge in a 2001 information security report to Congress. Recognizing the need for agencies to have effective information security programs, Congress passed the Federal Information Security Management Act of 2002 (FISMA), which provides the overall framework for ensuring the effectiveness of information security controls that support federal operations and assets. FISMA requirements apply to all federal contractors and organizations or sources that possess or use federal information or that operate, use, or have access to federal information systems on behalf of an agency. Our objectives were to (1) describe the information security risks associated with the federal government's reliance on contractor-provided IT systems and services and other users with privileged access to federal data and systems; (2) identify methods used by federal agencies to ensure security of information and information systems that are operated, used, or accessed by contractors and other users with privileged access to federal data; and (3) discuss steps the administration is taking to ensure implementation and oversight of security of information and information systems that are operated, used, or accessed by contractors and other users with privileged access to federal data and systems. Contractors and users with privileged access to federal data and systems provide valuable services that contribute to the efficient functioning of the government, but a range of risks (including operational, strategic, and legal) must be managed effectively. Most agencies recognize risks to the confidentiality, integrity, and availability of their information and systems associated with the use of contractors and other users with privileged access to federal data and systems. For example, malicious code can be inserted into agency software and systems. In addition, agencies also reported specific risks when contractors develop software or perform work at off-site facilities. Federal agencies reported additional risks to their operations posed by other users with privileged access to federal data and systems, such as lack of controlled network connections, poor access controls, and the introduction of viruses and worms. Agencies use contracts, policies, and self-assessments for ensuring information security oversight of contractors; however, each of these methods has limitations and needs further strengthening. Most agencies reported using contract language to establish information security requirements for contractors. However, agency-provided contract language generally did not address key elements of FISMA, such as annual testing of controls. In addition, the majority of agencies reported having information security policies for contractors and almost two-thirds of the agencies reported having such policies for other users with privileged access to federal data. Yet our analysis of agency-provided policies found that only 5 agencies had established policies that specifically addressed information security oversight of contractor-provided systems. Finally, the majority of agencies reported using the NIST self-assessment tool to assess contractor security capabilities. However, only 10 reported using the tool to assess the security implemented by other users with privileged access to federal data. The administration continues in its efforts to improve information security oversight of contractors, but challenges remain. For example, efforts to update the Federal Acquisition Regulation (FAR) to include the information security requirements of FISMA (which would be reflected in all relevant government contracts) have been under way since 2002, but are not yet complete. OMB continues to gather data about the number of agency systems, including those that are operated by contractors, and how many have been reviewed using a self-assessment tool. However, the data submitted showed that several agencies' chief information officers and inspectors general disagreed on the number of contractor or agency systems by as many as 100 systems or more. In addition, the data collected by OMB does not address other users with privileged access to federal data or the quality of the self assessments. Finally, NIST has developed guidance, parts of which are relevant to contractor security oversight. However, unified governmentwide guidance for overseeing information security of contractors and other users with privileged access to federal data and systems has not been issued.