In response to your request, our objectives were to identify existing governmentwide requirements and guidelines for certifying and accrediting federal information systems, determine the extent to which federal agencies have reported that their information systems are certified and accredited, and assess whether agencies’ certification and accreditation processes provide (1) consistent and comparable results, and (2) adequate information for authorizing officials to understand risks and make informed decisions. To determine what requirements and guidelines exist for agencies to follow in certifying and accrediting their systems, we obtained and reviewed information security policies and guidance issued by OMB, the National Institute of Standards and Technology (NIST), and DOD, including its National Security Agency and the Committee on National Security Systems, which is chaired by DOD’s Chief Information Officer. We also met with representatives from these agencies to discuss these policies and guidance, as well as to identify any planned revisions or additional guidance. This included guidance for both non-national security and national security systems. In addition, to help address all three of our objectives, we conducted a survey of 24 major departments and agencies, which included questions on the guidance they follow in certifying and accrediting their systems. To determine the extent to which agencies have certified and accredited their systems, we analyzed performance measurement data reported to OMB by the agencies for their fiscal year 2002 and 2003 annual reporting and for their March 2004 quarterly updates, which was due to OMB on March 15, 2004. This performance measurement data largely reflects non- national security systems, but some agencies also included data on national security systems. To assess whether agencies’ certification and accreditation processes provide consistent and comparable results and adequate information for authorizing officials, we analyzed the results of our survey to determine the extent to which agencies reported that their processes addressed specific criteria identified in federal certification and accreditation guidance, such as a current risk assessment and evidence of control testing. In addition, for selected systems at four agencies—the Departments of Commerce and Energy, the Environmental Protection Agency (EPA), and the National Aeronautics and Space Administration (NASA)—we also analyzed certification and accreditation documentation to determine whether the certification and accreditation criteria were met. We selected these agencies based primarily on the high percentages of certified and accredited systems they reported to OMB in their annual reports for fiscal years 2002 and 2003. We did not validate the accuracy of the data in agencies’ FISMA reports, survey responses, or system certification and accreditation documentation. However, we considered the data within the context of a significant body of existing knowledge and evidence about agency certification and accreditation practices and, to the extent that they addressed their agencies’ certification and accreditation efforts, reviewed and compared the results of agencies’ inspectors general (IG) fiscal year 2003 FISMA independent evaluations. We performed our work in the Washington, D.C., metropolitan area from September 2003 to June 2004, in accordance with generally accepted government auditing standards. FISMA permanently authorized information security program, evaluation, and reporting requirements for federal agencies. As a key element of agencies’ implementation of FISMA requirements, OMB has continued to emphasize its longstanding policy of requiring a management official to formally authorize an information system to process information and accept the risk associated with its operation based on a formal evaluation of the system’s security controls. Further, compliance with new FISMA- required standards and guidance will become important considerations in the certification and accreditation of agency systems. Enacted into law on December 17, 2002, as title III of the E-Government Act of 2002, FISMA assigns specific information security responsibilities to OMB, NIST, agency heads, chief information officers (CIO), and IGs. For OMB, these responsibilities include developing and overseeing the implementation of policies, principles, standards, and guidelines on information security; and reviewing at least annually, and approving or disapproving, agency information security programs. FISMA continues to delegate OMB responsibilities for national security systems to the Secretary of Defense and the Director of Central Intelligence. Therefore, OMB’s information technology policies and its authorities under FISMA, as well as federal information system standards and guidelines developed by NIST, generally do not apply to national security systems. However, according to FISMA, the head of each agency operating or exercising control of a national security system is responsible for providing information security protections commensurate with the risk and magnitude of harm, implementing information security policies and practices as required by standards and guidelines for national security systems, and complying with FISMA requirements. FISMA requires each agency, including agencies with national security systems, to develop, document, and implement an agencywide information security program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. Specifically, this program is to include periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; risk-based policies and procedures that cost-effectively reduce information security risks to an acceptable level and ensure that information security is addressed throughout the life cycle of each information system; subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems; security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. In addition to these information security program requirements, FISMA also requires each agency to develop, maintain, and annually update an inventory of major information systems (including major national security systems) operated by the agency or that are under its control. This inventory is to include an identification of the interfaces between each system and all other systems or networks, including those not operated by or under the control of the agency. Under FISMA, each agency must have an annual independent evaluation of its information security program and practices, including control testing and compliance assessment. Evaluations of non-national security systems are to be performed by the agency IG or by an independent external auditor, while evaluations related to national security systems are to be performed only by an entity designated by the agency head. Other major FISMA provisions require NIST to develop, for systems other than national security systems, (1) standards to be used by all agencies to categorize all their information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels; (2) guidelines recommending the types of information and information systems to be included in each category; and (3) minimum information security requirements for information and information systems in each category. In conjunction with DOD and the National Security Agency, NIST is responsible for developing guidelines for identifying an information system as a national security system. Since the mid-1980s, OMB policy for information technology (IT) management has required that an agency official attest to the adequacy of an information system’s security safeguards. As currently described in its Circular A-130, OMB requires federal agencies to ensure that a management official authorizes in writing the use of each general support system or major application based on implementation of its security plan before beginning or significantly changing its processing. This management approval, or accreditation, is the authorization of an IT system to process, store, or transmit information that provides a form of quality control and challenges managers and technical staff to find the best fit for security given technical constraints, operational constraints, and mission requirements. The accreditation decision is based on the implementation of an agreed-upon set of management, operational, and technical controls for a system, and is supported by a comprehensive evaluation or certification of these security controls that provides the necessary information for a management official to formally declare that a system is approved to operate at an acceptable level of risk. OMB policy also specifies the following: Security staff should not make the accreditation decision. In general, the security official is closer to the day-to-day operation of the system and will direct or perform security tasks, while the authorizing official will normally have general responsibility for the organization supported by the system. Agencies are required to reaccredit their systems prior to a significant change in processing, but at least every 3 years (more often where there is a high risk and potential magnitude of harm). With the implementation of FISMA, OMB has continued to emphasize system certification and accreditation by requiring agencies to report the number of systems certified and accredited as one of the key performance measures for reporting under these laws. Continuing this requirement as part of its overall authority under FISMA to develop and oversee the implementation of policies, principles, standards, and guidelines on information security, OMB has taken other steps to help integrate certification and accreditation into agencies’ information security programs. For example, in the President’s fiscal year 2004 budget, OMB established a governmentwide goal that 80 percent of federal IT systems be certified and accredited by the end of calendar year 2003. According to OMB, it also monitors the certification and accreditation of major systems through the budget process with the possibility that funding could be denied for those IT investments that do not meet security requirements, such as not being fully certified and accredited prior to becoming operational.