Virtually all federal operations are supported by automated systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions and account for their resources without these information assets. Therefore, it is important for agencies to safeguard their systems against risks such as loss or theft of resources (such as federal payments and collections), modification or destruction of data, and unauthorized uses of computer resources or to launch attacks on other computer systems. Sensitive information, such as taxpayer data, Social Security records, medical records, and proprietary business information could be inappropriately disclosed, browsed, or copied for improper or criminal purposes. Critical operations could be disrupted, such as those supporting national defense and emergency services or agencies’ missions could be undermined by embarrassing incidents, resulting in diminished confidence in their ability to conduct operations and fulfill their responsibilities. Cyber threats to federal systems and critical infrastructures can be unintentional and intentional, targeted or nontargeted, and can come from a variety of sources. Unintentional threats can be caused by software upgrades or maintenance procedures that inadvertently disrupt systems. Intentional threats include both targeted and nontargeted attacks. A targeted attack is when a group or individual specifically attacks a critical infrastructure system. A nontargeted attack occurs when the intended target of the attack is uncertain, such as when a virus, worm, or malware is released on the Internet with no specific target. The Federal Bureau of Investigation has identified multiple sources of threats to our nation’s critical information systems, including foreign nation states engaged in information warfare, domestic criminals, hackers, virus writers, and disgruntled employees working within an organization. Table 1 summarizes those groups or individuals that are considered to be key sources of cyber threats to our nation’s information systems and infrastructures. As federal information systems increase their connectivity with other networks and the Internet and as the system capabilities continue to increase, federal systems will become increasingly more vulnerable. Data from the National Vulnerability Database, the U.S. government repository of standards-based vulnerability management data, showed that, as of March 6, 2008, there were about 29,000 security vulnerabilities or software defects that can be directly used by a hacker to gain access to a system or network. On average, close to 18 new vulnerabilities are added each day. Furthermore, the database revealed that more than 13,000 products contained security vulnerabilities. These vulnerabilities become particularly significant when considering the ease of obtaining and using hacking tools, the steady advances in the sophistication and effectiveness of attack technology, and the emergence of new and more destructive attacks. Thus, protecting federal computer systems and the systems that support critical infrastructures has never been more important. FISMA sets forth a comprehensive framework for ensuring the effectiveness of security controls over information resources that support federal operations and assets. FISMA’s framework creates a cycle of risk management activities necessary for an effective security program, and these activities are similar to the principles noted in our study of the risk management activities of leading private sector organizations—assessing risk, establishing a central management focal point, implementing appropriate policies and procedures, promoting awareness, and monitoring and evaluating policy and control effectiveness. More specifically, FISMA requires the head of each agency to provide information security protections commensurate with the risk and magnitude of harm resulting from the unauthorized access, use, disclosure, disruption, modification or destruction of information and information systems used or operated by the agency or on behalf of the agency. In this regard, FISMA requires that agencies implement information security programs that, among other things, include periodic assessments of the risk; risk-based policies and procedures; subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems, as appropriate; security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, performed with a frequency depending on risk, but no less than annually; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies; procedures for detecting, reporting, and responding to security incidents; plans and procedures to ensure continuity of operations. In addition, agencies must develop and maintain an inventory of major information systems that is updated at least annually and report annually to the Director of OMB and several Congressional Committees on the adequacy and effectiveness of their information security policies, procedures, and practices and compliance with the requirements of the act. OMB and agency IGs also play key roles under FISMA. Among other responsibilities, OMB is to develop policies, principles, standards, and guidelines on information security and is required to report annually to Congress on agency compliance with the requirements of the act. OMB has provided instructions to federal agencies and their IGs for preparing annual FISMA reports. OMB’s reporting instructions focus on performance metrics related to the performance of key control activities such as developing a complete inventory of major information systems, providing security training to personnel, testing and evaluating security controls, testing contingency plans, and certifying and accrediting systems. Its yearly guidance also requires agencies to identify any physical or electronic incidents involving the loss of, or unauthorized access to, personally identifiable information. FISMA also requires agency IGs to perform an independent evaluation of the information security programs and practices of the agency to determine the effectiveness of such programs and practices. Each evaluation is to include (1) testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the agency’s information systems and (2) assessing compliance (based on the results of the testing) with FISMA requirements and related information security policies, procedures, standards, and guidelines. These required evaluations are then submitted by each agency to OMB in the form of an OMB-developed template that summarizes the results. In addition to the template submission, OMB encourages agency IGs to provide any additional narrative in an appendix to the report to the extent they provide meaningful insight into the status of the agency’s security or privacy program. Major federal agencies have continued to report steady progress over the past several years in performing information security control activities, although IGs at several agencies identified inconsistencies with reported information. According to OMB and agency FISMA reports, the federal government continued to improve information security performance in fiscal year 2007 relative to key performance metrics established by OMB. For fiscal year 2007, IGs reported that more agencies had completed approximately 96-100 percent of their inventories and the governmentwide percentage of employees with significant security responsibilities who received specialized training increased. Percentages also increased for systems that had been tested and evaluated at least annually, systems with tested contingency plans, and systems that had been certified and accredited. However, agencies reported a decline in the percentage of employees and contractors who received security awareness training (see fig. 1). In addition, IGs at several agencies sometimes disagreed with the information reported by the agency and have identified weaknesses in the processes used to implement these and other security program activities. In fiscal year 2007, 24 major federal agencies reported a total of 10,285 systems, composed of 8,933 agency and 1,352 contractor systems. Table 2 summarizes the number of agency and contractor systems by system impact level. IGs reported that 19 agencies had completed approximately 96-100 percent of their inventories, an increase from 18 agencies in 2006. However, IGs identified problems with system inventories at several agencies. For example, three agency IGs did not agree with the reported number of agency systems or systems operated by a contractor or another organization on the agency’s behalf and one IG for a large agency reported that it did not agree with the number of agency owned systems. Additionally, one agency IG identified discrepancies in the number of system interfaces and interconnections reported and one IG reported the agency lacked procedures to ensure contractor systems are identified. Without complete and accurate inventories, agencies cannot effectively maintain and secure their systems. In addition, the performance measures used to assess agencies’ progress may not accurately reflect the extent to which these security practices have been implemented. Overall, agencies reported a decline in the percentage of employees and contractors receiving security awareness training. According to agency FISMA reports, 84 percent of total employees and contractors governmentwide received security awareness training in fiscal year 2007, a decrease from 2006 in which 91 percent of employees and contractors governmentwide received security awareness training. However, 10 agencies reported increasing percentages of employees and contractors receiving security awareness training and five other agencies continue to report that 100 percent of their employees and contractors received security awareness training. In addition, each agency reported it had explained policies regarding peer-to-peer file sharing in security awareness training, ethics training, or other agencywide training. Governmentwide, agencies reported an increasing percentage of employees with significant security responsibilities who received specialized training. In fiscal year 2007, 90 percent of these employees had received specialized training, compared with 86 percent in fiscal year 2006. Although the majority of agencies reported improvements in both the percentage of employees and contractors receiving security awareness training and the percentage of employees with significant security responsibilities who received specialized training, several did not. For example, nine agencies reported a decrease in the percentage of employees and contractors who received security awareness training. In addition, several IGs reported weaknesses in agencies security awareness and training efforts. For example, one IG reported that the agency was unable to ensure that contractors received security awareness training and another IG reported that the agency security awareness program needs to increase employees’ awareness of social engineering techniques and the importance of protecting their usernames and passwords as a result of successful social engineering attempts. Two agency IGs also noted that weaknesses exist in ensuring that all employees who have specialized responsibilities receive specialized training. Further, eight agency IGs disagree with the percentage of individuals that their agency reported as having received security awareness training. Figure 2 shows a comparison between agency and IG reporting of the percentage of employees receiving security awareness training. Failure to provide up-to-date information security awareness training could contribute to the information security problems at agencies.