Information security is an important consideration for any organization that depends on information systems to carry out its mission. The dramatic expansion in computer interconnectivity and the exponential increase in the use of the Internet are changing the way our government, the nation, and much of the world communicate and conduct business. However, risks are significant, and they are growing. The number of computer security incidents reported to the CERT Coordination Center (CERT/CC) rose from 9,859 in 1999 to 21,756 in 2000. For the first 6 months of 2001, the number reported was 15,476. As the number of individuals with computer skills has increased, more intrusion or “hacking” tools have become readily available and relatively easy to use. A potential hacker can literally download tools from the Internet and "point and click" to start a hack. According to a recent National Institute of Standards and Technology (NIST) publication, hackers post 30 to 40 new tools to hacking sites on the Internet every month. The successful cyber attacks against such well-known U.S. e- commerce Internet sites as eBay, Amazon.com, and CNN.com by a 15-year old "script kiddie" in February 2000 illustrate the risks. Without proper safeguards, these developments make it easier for individuals and groups with malicious intentions to gain unauthorized access to systems and use their access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other organizations’ sites. incidents reported in 2000, which occurred at 32 agencies, resulted in what is known as a “root compromise.” For at least five of the root compromises, government officials were able to verify that access to sensitive information had been obtained. How well federal agencies are addressing these risks is a topic of increasing interest in the executive and legislative branches. In January 2000, President Clinton issued a National Plan for Information Systems Protection and designated computer security and critical infrastructure protection a priority management objective in his fiscal year 2001 budget. The new administration, federal agencies, and private industry have collaboratively begun to prepare a new version of the national plan that will outline an integrated approach to computer security and critical infrastructure protection. The Congress, too, is increasingly interested in computer security, as evidenced by important hearings held during 1999, 2000, and 2001 on ways to strengthen information security practices throughout the federal government and on progress at specific agencies in addressing known vulnerabilities. Furthermore, in October 2000, the Congress included government information security reform provisions in the fiscal year 2001 National Defense Authorization Act. These provisions seek to ensure proper management and security for federal information systems by calling for agencies to adopt risk management practices that are consistent with those summarized in our 1998 Executive Guide. The provisions also require annual agency program reviews and Inspector General (IG) evaluations that must be reported to the Office of Management and Budget (OMB) as part of the budget process. The federal CIO Council and others have also initiated several projects that are intended to promote and support security improvements to federal information systems. Over the past year, the CIO Council, working with NIST, OMB, and us, developed the Federal Information Technology Security Assessment Framework. The framework provides agencies with a self-assessment methodology to determine the current status of their security programs and to establish targets for improvement. OMB has instructed agencies to use the framework to fulfill their annual assessment and reporting obligations. Since 1996, our analyses of information security at major federal agencies have shown that systems are not being adequately protected. Our previous reports, and those of agency IGs, describe persistent computer security weaknesses that place a variety of critical federal operations at risk of inappropriate disclosures, fraud, and disruption. This body of audit evidence has led us, since 1997, to designate computer security as a governmentwide high-risk area. Our most recent summary analysis of federal information systems found that significant computer security weaknesses had been identified in 24 of the largest federal agencies, including Commerce. During December 2000 and January 2001, Commerce's IG also reported significant computer security weaknesses in several of the department's bureaus and, in February 2001, reported information security as a material weakness affecting the department's ability to produce accurate data for financial statements. The report stated that there were weaknesses in several areas, including entitywide security management, access controls, software change controls, segregation of duties, and service continuity planning. Moreover, a recent IG assessment of the department's information security program found fundamental weaknesses in the areas of policy and oversight. Also, the IG designated information security as one of the top ten management challenges for the department. Commerce's missions are among the most diverse of the federal government's cabinet departments, covering a wide range of responsibilities that include observing and managing natural resources and the environment; promoting commerce, regional development, and scientific research; and collecting, analyzing, and disseminating statistical information. Commerce employs about 40,000 people in fourteen operating bureaus with numerous offices in the U.S. and overseas, each pursuing disparate programs and activities. IT is a critical tool for Commerce to support these missions. The department spends significant resources—reportedly over $1.5 billion in fiscal year 2000—on IT systems and services. As a percentage of total agency expenditures on IT, Commerce ranks among the top agencies in the federal government, with 17 percent of its $9-billion fiscal year 2000 budget reported as spent on IT. A primary mission of Commerce is to promote job creation and improved living standards for all Americans by furthering U.S. economic growth, and the seven bureaus we reviewed support this mission through a wide array of programs and services. Commerce uses IT to generate and disseminate some of the nation’s most important economic information. The International Trade Administration (ITA) promotes the export of U.S. goods and services—which amounted to approximately $1.1 trillion in fiscal year 2000. Millions of American jobs depend on exports, and with 96 percent of the world's consumers living outside U.S. borders, international trade is increasingly important to supporting this mission. The Economics and Statistics Administration (ESA) develops, prepares, analyzes, and disseminates important indicators of the U.S. that present basic information on such key issues as economic growth, regional development, and the U.S. role in the world economy. This information is of paramount interest to researchers, business, and policymakers. The Bureau of Export Administration (BXA), whose efforts supported sales of approximately $4.2 billion in fiscal year 1999, assists in stimulating the growth of U.S. exports while protecting national security interests by helping to stop the proliferation of weapons of mass destruction. Sensitive data such as that relating to national security, nuclear proliferation, missile technology, and chemical and biological warfare reside in this bureau's systems. Commerce's ability to fulfill its mission depends on the confidentiality, integrity, and availability of this sensitive information. For example, export data residing in the BXA systems reflect technologies that have both civil and military applications; the misuse, modification, or deletion of these data could threaten our national security or public safety and affect foreign policy. Much of these data are also business proprietary. If it were compromised, the business could not only lose its market share, but dangerous technologies might end up in the hands of renegade nations who threaten our national security or that of other nations. Commerce's IT infrastructure is decentralized. Although the Commerce IT Review Board approves major acquisitions, most bureaus have their own IT budgets and act independently to acquire, develop, operate, and maintain their own infrastructure. For example, Commerce has 14 different data centers, diverse hardware platforms and software environments, and 20 independently managed e-mail systems. The bureaus also develop and control their own individual networks to serve their specific needs. These networks vary greatly in size and complexity. For example, one bureau has as many as 155 local area networks and 3,000 users spread over 50 states and 80 countries. Some of these networks are owned, operated, and managed by individual programs within the same bureau. Because Commerce does not have a single, departmentwide common network infrastructure to facilitate data communications across the department, the bureaus have established their own access paths to the Internet, which they rely on to communicate with one another. In April 2001, the department awarded a contract for a $4 million project to consolidate the individual bureaus' local area networks within its headquarters building onto a common network infrastructure. However, until this project is completed, each of the bureaus is expected to continue to configure, operate, and maintain its own unique networks. Recognizing the importance of its data and operations, in September 1993 Commerce established departmentwide information security policies that defined and assigned a full set of security responsibilities, ranging from the department level down to individual system owners and users within the bureaus. Since 1998, the Commerce CIO position has been responsible for developing and implementing the department’s information security program. An information security manager, under the direction of the CIO's Office of Information Policy, Planning, and Review, is tasked with carrying out the responsibilities of the program. The CIO's responsibilities for the security of classified systems has been delegated to the Office of Security. In the last 2 years, the CIO introduced several initiatives that are essential to improving the security posture of the department. After a 1999 contracted evaluation of the bureaus' security plans determined that 43 percent of Commerce's most critical assets did not have current information system security plans, the CIO issued a memorandum calling for the bureaus to prepare security plans that comply with federal regulations. Also, in May 2000, the Office of the CIO performed a summary evaluation of the status of all the bureaus' information security based on the bureaus' own self-assessments. The results determined that overall information security program compliance was minimal, that no formal information security awareness and training programs were provided by the bureaus, and that incident response capabilities were either absent or informal. The Commerce IG indicated that subsequent meetings between the Office of the CIO and the bureaus led to improvements.