To address the challenge of responding to current and potential threats to homeland security—one of the federal government’s most significant challenges—Congress passed, and the President signed, the Homeland Security Act of 2002. This act mandated the merger of 22 federal agencies and organizations into DHS. Not since the creation of the Department of Defense in 1947 has the federal government undertaken a transformation of this magnitude. In March 2003, DHS assumed operational control of about 209,000 civilian and military positions from these 22 federal agencies and organizations. Each of these agencies and organizations brought with it management challenges, distinct missions, unique information technology infrastructures and systems, and its own policies and procedures. Because of the importance of the department’s operations and the challenges associated with creating the federal government’s third largest department, we designated the implementation and transformation of DHS as a high- risk area in January 2003. DHS’s mission, in part, is to prevent and deter terrorist attacks within the United States, reduce the vulnerability of the United States to terrorism, and to minimize the damage, and assist in the recovery, from terrorist attacks that do occur. This is an exceedingly complex mission that requires coordinated and focused effort from the federal government, state and local governments, the private sector, and the American people. The Department of Homeland Security Appropriations Act of 2005, provided $28.9 billion in net discretionary spending for DHS to carry out its mission. To accomplish its mission, the Homeland Security Act of 2002 established five under secretaries with responsibilities over directorates for management, science and technology, information analysis and infrastructure protection, border and transportation security, and emergency preparedness. Each directorate is responsible for its specific homeland security mission area. DHS aligned the 22 federal agencies and organizations into 13 major agency components (see fig. 1). The 13 components and their missions: Office of Management—responsible for such things as the budget, appropriations, expenditure of funds, accounting and finance, procurement, and information technology. Science and Technology—serve as the primary research and development arm of DHS with a focus on catastrophic terrorism— threats to the security of our homeland that could result in large-scale loss of life and major economic impact. Transportation Security Administration—protect the nation’s transportation systems by ensuring the freedom of movement for people and commerce. Customs and Border Protection—manage, control, and protect the nation’s borders at and between the official ports of entry. Immigration and Customs Enforcement—prevent acts of terrorism by targeting the people, money, and materials that support terrorist and criminal activities. It is the largest investigative arm of DHS. Federal Law Enforcement Training Center—prepare federal, state, local, and international law enforcement professionals to fulfill their responsibilities safely and proficiently, ensuring that training is accomplished in the most cost-effective manner. Emergency Preparedness and Response—ensure that our nation is prepared for incidents—whether natural disasters or terrorist assaults—and oversees the federal government’s national response and recovery strategy. Information Analysis and Infrastructure Protection—help deter, prevent, and mitigate acts of terrorism by assessing vulnerabilities in the context of continuously changing threats. Citizen and Immigration Services—promote national security, eliminate immigration case backlogs, improves customer services, and provide administrative services such as immigrant and nonimmigrant sponsorship, work authorization and other permits, and naturalization of qualified applicants for U.S. citizenship. Office of the Inspector General (OIG)—serve as an independent and objective inspection, audit, and investigative body to promote effectiveness, efficiency, and economy in the DHS’s programs and operations, and to prevent and detect fraud, abuse, mismanagement, and waste in such programs and operations. U.S. Coast Guard—protect the public, the environment, and U.S. economic interests in the nation’s ports and waterways, along the coast, on international waters, or in any maritime region, as required to support national security. U.S. Secret Service—protect the President and our nation’s leaders, as well as our country’s financial and critical infrastructures. United States Visitor and Immigrant Status Indicator Technology (US-VISIT)— a DHS program intended to collect, maintain, and share information on foreign nationals through Immigration and Customs Enforcement and Customs and Border Protection systems in order to expedite the arrival and departure of legitimate travelers, while making it more difficult for those intending to do harm to our nation. Within the Office of the Under Secretary Management is the Office of the Chief Information Officer (CIO). Under the authorities of the Clinger-Cohen Act of 1996, FISMA, and DHS management directives, the DHS CIO is responsible for ensuring compliance with federal information security requirements and reporting annually to the DHS Secretary on the effectiveness of the department’s information security program. The CIO designated the CISO, under the authorities of FISMA, to carry out specific information security responsibilities that include developing and maintaining a departmentwide information security program, as required by FISMA; developing departmental information security policies and procedures to address the requirements of FISMA; providing the direction and guidance necessary to ensure that information security throughout the department is compliant with federal information security requirements and policies; and advising the CIO on the status and issues involving security aspects of the departmentwide information security program. In addition, the CISO is responsible for oversight functions such as those required to ensure that DHS has departmentwide, repeatable, and robust processes for meeting federal information security requirements and that the components accurately assess their security postures. Information system security managers at each of the components are expected to assist the CISO in carrying out its oversight functions. Security managers have the role of maintaining the confidentiality, integrity, and availability of the DHS programs and systems that support the department’s missions and operations. They are responsible for providing the link between the departmentwide information security program and the components. Security managers are also responsible for ensuring that the information system security officers and program officials at their respective components are in compliance with federal information security requirements and policies. Information system security officers serve as the focal point for information security activities at the system level in each DHS component. Among other things, security officers have the responsibility for ensuring that appropriate steps are taken to implement information security requirements for information systems throughout their life cycle. Security managers directly report to the CIO at their respective component and security officers directly report to their program officials, who directly report to their respective component heads. Program officials are required to implement information security controls and manage risk for information assets pertaining to their business need. The department uses a variety of major applications and general support systems to support its operations. A major application is one that requires special attention due to the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the application. A general support system is an interconnected set of information resources under the same direct management control that shares common functionality. It normally includes hardware, software, information, data, applications, communications and people and can be, for example, a local area network or communications network. Many of these applications and systems serve specific requirements unique to individual component’s missions and result in interoperability issues, data management concerns, and incompatible environments or duplicative/inefficient processes. As noted in DHS’s March 2004 Information Resource Management Strategic Plan, DHS’s CIO has established the goal of forming one network and one information technology infrastructure to facilitate information sharing within the department and among DHS and external federal, state, and local agencies. Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission. It is especially important for government agencies, where maintaining the public’s trust is essential. The dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet are changing the way our government, the nation, and much of the world communicate and conduct business. Without proper safeguards, they also pose enormous risks that make it easier for individuals and groups with malicious intent to intrude into inadequately protected systems and use such access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. Protecting the computer systems that support critical operations and infrastructures has never been more important because of the concern about attacks from individuals and groups, including terrorists. These concerns are well-founded for a number of reasons, including the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technologies, and the dire warnings of new and more destructive attacks to come. Computer-supported federal operations are likewise at risk. Our previous reports, and those of agency inspectors general, describe persistent information security weaknesses that place a variety of critical federal operations, including DHS, at risk of disruption, fraud, and inappropriate disclosure. Enacted into law on December 17, 2002, as Title III of the E-Government Act of 2002, FISMA authorized and strengthened information security program, evaluation, and reporting requirements. FISMA assigns specific responsibilities to agency heads, chief information officers, and Inspectors General (IG). It assigns responsibilities to the OMB as well; these include developing and overseeing the implementation of policies, principles, standards, and guidelines for information security; reviewing agency information security programs at least annually; and approving or disapproving these programs. FISMA requires each agency to develop, document, and implement a departmentwide information security program. This program should establish security measures for the information and information systems that support the operations and assets of the agency—including those provided or managed by another agency, a contractor, or another source.