Information security is a critical consideration for any agency that depends on information systems and computer networks to carry out its mission and is especially important for a federal agency such as FDA, which collects, processes, and stores sensitive information on drugs and other products pending approval; the safety of food, drug, and medical products; and scientific research to inform regulatory decisions. While the use of interconnected electronic information systems allows the agency to accomplish its mission more quickly and effectively, this also exposes FDA’s information to threats from sources internal and external to the agency. Internal threats can include errors, as well as fraudulent or malevolent acts by employees or contractors working within the agency. External threats include the ever-growing number of cyber-based attacks that can come from a variety of sources, including hackers, criminals, foreign nations, terrorists, and other adversarial groups. Potential cyber attackers have a variety of techniques at their disposal, which can vastly enhance the reach and impact of their actions. For example, these attackers do not need to be physically close to their targets, their attacks can easily cross state and national borders, and they can more readily preserve their anonymity. Additionally, advanced persistent threats—where an adversary that possesses sophisticated levels of expertise and significant resources can use physical and cyber methods to achieve its objectives—pose increasing risks. Further, the interconnectivity among information systems presents increasing opportunities for such attacks. This risk is highlighted by the rising number of reported security incidents at federal agencies. Specifically, the number of incidents reported by federal agencies to the United States Computer Emergency Readiness Team (US-CERT) has increased dramatically in recent years. It rose from 5,503 in fiscal year 2006 to 77,183 in fiscal year 2015. Compounding the growing number and types of threats are the deficiencies in security controls on the information systems at federal agencies. These weaknesses have resulted in vulnerabilities in systems and information and continue to place assets at risk of inadvertent or deliberate misuse; information at risk of unauthorized access, modification, or destruction; and critical operations at risk of disruption. Accordingly, we have designated federal information security as a government-wide high-risk area since 1997, and in 2003 expanded this area to include computerized systems supporting the nation’s critical infrastructure. In February 2015, we further expanded this area to include protecting the privacy of personal information that is collected, maintained, and shared by both federal and nonfederal entities. In September 2015, we reported that more than half of the 24 major federal agencies continued to experience weakness in the controls intended to preserve confidentiality—preventing unauthorized access to information and systems; integrity—preventing unauthorized modification or destruction of information, including access and configuration controls; and availability—ensuring timely and reliable access to and use of information when needed, such as contingency planning controls. To improve federal information security, the Federal Information Security Modernization Act (FISMA) was enacted in 2014. The law is intended to address the increasing sophistication of cybersecurity attacks, promote the use of automated security tools with the ability to continuously monitor and diagnose the security posture of federal agencies, and provide for improved oversight of federal agencies’ information security programs. FISMA provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. Among other things, FISMA requires federal agencies to develop, document, and implement an agency-wide information security program. Agencies are to carry this out using a risk-based approach to information security management. Such a program includes developing and implementing cost-effective security policies, plans, and procedures; assessing risk; providing specialized training; testing and evaluating the effectiveness of controls; planning, implementing, evaluating, and documenting remedial actions to address information security deficiencies; and ensuring continuity of operations. FISMA also gives the National Institute of Standards and Technology (NIST) responsibility for developing standards and guidelines that include minimum information security requirements. To this end, NIST has issued numerous publications to provide guidance for agencies in implementing an information security program. These include, among others, the NIST Federal Information Processing Standard (FIPS) 199, which provides requirements for agencies to categorize their systems and information, and NIST Special Publication (SP) 800-53, which provides guidance on the selection and implementation of information security and privacy controls for systems. FDA is a consumer protection agency with broad regulatory authority charged with protecting public health by ensuring the safety, effectiveness, and security of human veterinary drugs, biological products, and medical devices; ensuring the safety of foods, cosmetics, and radiation-emitting products; and regulating tobacco products. FDA’s mission includes helping to speed innovations that make foods safer and medicines and medical devices safer and more effective; ensuring members of the public have accurate, science-based information they need to use medicines, devices, and foods to improve their health; regulating the manufacture, marketing, and distribution of tobacco products and reducing tobacco use by minors; and addressing the nation’s counterterrorism capability by ensuring the security of the supply of foods and medical products. FDA performs regulatory activities that include reviewing and approving new drugs and certain medical products; inspecting manufacturing facilities for compliance with regulations and good manufacturing practices; and conducting post-market surveillance of food, drug, and medical products to ensure they are safe; tracking and identifying the source of outbreaks of foodborne illnesses; and issuing recall notices and safety alerts for products that threaten the public health. According to FDA, its fiscal year 2015 appropriation was $4.5 billion. The agency is headed by a Commissioner and is staffed by more than 14,000 employees across the United States and around the world. FDA consists of its Office of the Commissioner and four directorates that oversee the agency’s core functions. These directorates are the Office of Foods and Veterinary Medicine, Office of Global Regulatory Operations and Policy, Office of Medical Products and Tobacco, and Office of Operations. Within these directorates are offices and centers that focus on core parts of the agency’s mission. Examples of these offices and centers are shown in table 1. FDA relies extensively on IT to fulfill its mission and support related administrative needs. Among the more than 80 systems reported in its FISMA inventory, the agency has systems dedicated to supporting its product review and evaluation activities, regulatory compliance functions, and product safety monitoring activities, as well as systems to support administrative processes. All of these systems are supported by an IT infrastructure that includes network components, critical servers, and data centers. In fiscal year 2015, the agency reported spending $585 million on IT, of which approximately $12 million (or about 2 percent of the IT budget) was for information security. This percentage is lower than the approximately 8 percent of their fiscal year 2015 IT spending that the 23 civilian agencies covered by the Chief Financial Officers Act reportedly spent on information security. For fiscal year 2016, FDA requested $640 million for IT and $16 million for information security. In addition, FDA indicated that real-time connectivity and access to data and information is essential for its daily operations, as well as its interactions with the public and other partners. These factors depend on high-quality, high-availability, and high-performing data networks, server and application infrastructure, communications services, simple and complex computer applications, mobile workforce capabilities, and rapid and responsive service delivery. Examples of the processing activities that key FDA systems perform in supporting of the agency’s mission are listed below: Support and facilitate post-market product safety surveillance of human drugs, biologics, devices, and combination products. Provide a data repository for collecting, storing, viewing, analyzing, reporting, and tracking the receipt of adverse event data or medication errors. Establish a single gateway or communications portal for accepting electronic submissions or allowing authorized users to view or obtain information. Examples of electronic submissions include industry- provided trade secrets, adverse event records, and a multitude of different records related to FDA’s regulatory oversight of regulated products. Provide capabilities for regulatory scientific research, while also supporting FDA’s overall goals and objectives in areas where information technology requires supercomputer-strength computational power. Support FDA’s research and development activities. Provide a platform through which FDA organizations may disseminate FDA-related information to interested parties, including the public, health professionals, regulated industries, and the media. Provide information about the various product areas that FDA regulates (food, drugs, medical devices, cosmetics, etc. ), timely advisories (e.g., anticipated disease outbreaks such as the Severe Acute Respiratory Syndrome (SARS), buying medicines online, and LASIK surgery), and other FDA activities. Provide links to related reference materials and opportunities for consumers and industry to interact with the FDA. Provide basic network and security capabilities for the FDA enterprise. Facilitate receipt and review of electronic drug applications. This function includes scans and checks of the validity of drug submissions from industry and making them available for reviewers, as well as providing file shares for storing successful submissions that are to be reviewed. In addition, FDA contractors support data centers and systems that provide, among other things, the network infrastructure for the agency’s systems and its public website. The information handled by these systems includes sensitive or confidential business information on drug submissions and adverse event reports, among other types of information. Accordingly, effective implementation of security controls is necessary to protecting the confidentiality, integrity, and availability of FDA’s information and in preventing the occurrence or lowering the risks of security breaches similar to one the agency experienced in 2013. During that breach, an intruder gained unauthorized access to one FDA system’s user accounts and passwords. Effective controls can help ensure only authorized users (people and processes) access information and systems to lessen the chances of unauthorized disclosures of information, improper changes or modifications to FDA’s information and systems, and system disruptions that could hamper the agency’s ability to perform its mission.