To help protect against threats to federal systems, FISMA sets forth a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. Its framework creates a cycle of risk management activities necessary for an effective security program. It is also intended to provide a mechanism for improved oversight of federal agency information security programs. In order to ensure the implementation of this framework, FISMA assigns specific responsibilities to (1) OMB, to develop and oversee the implementation of policies, principles, standards, and guidelines on information security; to report, at least annually, on agency compliance with the act; and to approve or disapprove, agency information security programs; (2) agency heads, to provide information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency; (3) agency heads and chief information officers, to develop, document, and implement an agencywide information security program, among others; (4) inspectors general, to conduct annual independent evaluations of agency efforts to effectively implement information security; and (5) NIST to provide standards and guidance to agencies on information security. FISMA also assigns responsibility to OMB for ensuring the operation of a federal information security incident center. The required functions of this center are performed by the Department of Homeland Security’s (DHS) United States Computer Emergency Readiness Team (US-CERT), which was established to aggregate and disseminate cybersecurity information to improve warning and response to incidents, increase coordination of response information, reduce vulnerabilities, and enhance prevention and protection. In addition, the act requires each agency to report annually to OMB, selected congressional committees, and the Comptroller General on the adequacy of its information security policies, procedures, practices, and compliance with requirements. FISMA also requires OMB to report annually to Congress by March 1. See appendix II for additional information on the responsibilities of each entity. Federal agencies’ information and information systems remain at risk. This risk is illustrated in part by the rising numbers of incidents reported by federal agencies in fiscal year 2010. At the same time, weaknesses in their information security policies and practices compromised their efforts to protect against threats. Furthermore, our work and reviews by inspectors general highlight information security control deficiencies at agencies that expose information and information systems supporting federal operations and assets to elevated risk of unauthorized use, disclosure, modification, and disruption. Accordingly, we and agency inspectors general have made hundreds of recommendations to agencies in fiscal years 2010 and 2011 to address these security control deficiencies. Federal agencies have reported increasing numbers of security incidents that placed sensitive information at risk. When incidents occur, agencies are to notify the federal information security incident center—US-CERT. Over the past 5 years, the number of incidents reported by federal agencies to US-CERT has increased from 5,503 incidents in fiscal year 2006 to 41,776 incidents in fiscal year 2010, an increase of over 650 percent (see fig.1). Agencies also reported the following types of incidents and events based on US-CERT-defined categories:  Unauthorized access: Gaining logical or physical access to a federal agency’s network, system, application, data, or other resource without permission.  Denial of service: Preventing or impairing the normal authorized functionality of networks, systems, or applications by exhausting resources. This activity includes being the victim of or participating in a denial of service attack.  Malicious code: Installing malicious software (e.g., virus, worm, Trojan horse, or other code-based malicious entity) that infects an operating system or application. Agencies are not required to report malicious logic that has been successfully quarantined by antivirus software. Improper usage: Violating acceptable computing use policies.  Scans/probes/attempted access: Accessing or identifying a federal agency computer, open ports, protocols, service, or any combination of these for later exploit. This activity does not directly result in a compromise or denial of service.  Unconfirmed incidents under investigation: Investigating unconfirmed incidents that are potentially malicious or anomalous activity deemed by the reporting entity to warrant further review. According to DHS officials, these incidents include those that US- CERT detects through its intrusion detection system, supplemented by agency reports for investigation. As indicated in figure 2, the four most prevalent types of incidents and events reported to US-CERT during fiscal year 2010 were: (1) malicious code; (2) unconfirmed incidents under investigation; (3) improper usage; and (4) unauthorized access. Reported attacks and unintentional incidents involving federal systems and critical infrastructure systems demonstrate that a serious attack could be devastating. Agencies have experienced a wide range of incidents involving data loss or theft, computer intrusions, and privacy breaches, underscoring the need for improved security practices. The following examples, included to reflect incidents reported in 2010 and 2011, illustrate that a broad array of information and assets remain at risk.  An employee at federal financial institution downloaded unauthorized accounting source code to a bank hard drive which he had previously reported as stolen. The institution’s internal security personnel are investigating and believe the bank employee may have shared the code with a student in another country.  A well-known hacker group, according to an online news journal, was planning a cyber protest attack on a federal agency, using mobile phones and massive crowds of supporters as well as online supporters. This attack was intended to slow or stop traffic in and out of the agency and delay operations.  A user on a department’s network was tricked by a carefully crafted e- mail to go to a website on the pretense that he had won a new car in a lottery he supposedly entered by answering some simple questions about his pets. Later, he found that several credit cards had been opened in his name and large amounts of pet supplies had been ordered without his knowledge.  A contractor working for a federal agency sent an unencrypted e-mail from his workstation to his personal e-mail account. This was detected by a monitoring tool at the agency and an immediate investigation was initiated. Several agency personnel had their personal information sent in an unencrypted e-mail to an unauthorized account.  Network security personnel at a federal institution noted that a large number of network probes on their system originated from an underground hacking group. The institution contacted US-CERT and asked that it contact the service provider to request that the IP address be blocked so that it could no longer probe the institution.  A federal agency’s website was reportedly attacked by a hacker group. Initial analysis determined the hack took place via a web implementation of Java. The attackers have not completely taken down the web server; however, considerable peaks of traffic have been detected. Our audits have identified information security deficiencies in both financial and nonfinancial systems, including vulnerabilities in federal systems. We have made hundreds of recommendations to agencies in fiscal years 2010 and 2011 to address these security control deficiencies. However, most of these recommendations have not yet been fully implemented. The following examples, reported in 2010 and 2011, describe the risks we found at federal agencies, our recommendations, and the actions the agencies plan to take. In March 2011, we reported that the Internal Revenue Service had made progress in correcting previously reported information security weaknesses, but a significant number of them remained unresolved or unmitigated. For example, the agency did not sufficiently (1) restrict users’ access to databases to only the access needed to perform their jobs; (2) secure the system it uses to support and manage its computer access request, approval, and review processes; (3) update database software residing on servers that support its general ledger system; and (4) enable certain auditing features on databases supporting financial and tax processing systems. An underlying reason for these weaknesses was that the Internal Revenue Service had not yet fully implemented required components of its comprehensive information security program. As a result, financial and taxpayer information remain unnecessarily vulnerable to insider threats and at increased risk of unauthorized disclosure, modification, or destruction; financial data are at increased risk of errors that result in misstatement; and the agency’s management decisions may be based on unreliable or inaccurate financial information. We recommended that the Internal Revenue Service take 32 specific actions for correcting newly identified control weaknesses, and it agreed to develop a detailed corrective action plan that addresses them. In November 2010, we reported that the Federal Deposit Insurance Corporation did not sufficiently implement access and other controls intended to protect the confidentiality, integrity, and availability of its financial systems and information. For example, it did not always (1) sufficiently restrict user access to systems; (2) ensure strong system boundaries; (3) consistently enforce strong controls for identifying and authenticating users; (4) encrypt sensitive information; or (5) audit and monitor security-relevant events. In addition, the Federal Deposit Insurance Corporation did not have policies, procedures, and controls in place to ensure the appropriate segregation of incompatible duties, adequately manage the configuration of its financial information systems, and update contingency plans. An underlying reason for these weaknesses was that the corporation did not always fully implement several information security program activities, such as effectively developing, documenting, and implementing security policies. As a result, it faced an elevated risk of the misuse of federal assets, unauthorized modification or destruction of financial information, inappropriate disclosure of other sensitive information, and disruption of computer operations. Accordingly, we recommended that the corporation fully implement several key activities to enhance its information security program. The Federal Deposit Insurance Corporation generally agreed with our recommendations and stated that it planned to address the identified weaknesses. In October 2010, we reported that the National Archives and Records Administration had not effectively implemented information security controls to sufficiently protect the confidentiality, integrity, and availability of the information and systems that support its mission.