The Department of the Treasury is authorized by the Congress to borrow money on the credit of the United States to fund operations of the federal government. The Bureau of the Public Debt is the organizational entity within Treasury that is responsible for prescribing the debt instruments and limiting and restricting the amount and composition of the debt. BPD accomplishes this by issuing marketable Treasury bills, notes, and bonds as well as nonmarketable securities, such as U.S. Savings Bonds. The bureau is also responsible for paying interest to investors and redeeming investors’ securities. In addition, BPD has been given the responsibility to issue Treasury securities to trust funds for trust fund receipts not needed for current benefits and expenses. During fiscal year 1997, BPD issued over $2.34 trillion in Treasury securities to the public while redeeming about $2.31 trillion of debt held by the public. Most of the $2.34 trillion was raised through more than 160 securities auctions as well as the continual sale of savings securities at 40,000 locations throughout the country and investments in securities by state and local governments. Further, there was $152 billion of net borrowings from federal entities, primarily trust funds. BPD relies on a number of financial systems to process and track the money that is borrowed and to account for the securities it issues. One of its primary systems is the Public Debt Accounting and Reporting System, which is used to account for the federal debt. BPD also relies on various other systems to track marketable securities, savings bonds, and securities issued to state and local government entities and to generate interest transactions for the different securities. All of BPD’s financial activities are processed at its data processing center in Parkersburg, West Virginia. In carrying out its debt responsibilities, BPD receives assistance from Federal Reserve Banks (FRB) located throughout the country, which serve as Treasury’s fiscal agents. For instance, FRBs issue Treasury securities in electronic (book entry) form upon authorization by the Treasury and administer principal and interest payments on these securities. There are 12 FRBs with 25 branches throughout the country. FRBs use a number of information systems to help process issuance and redemption activities; generate interest payments; and account for marketable Treasury securities, nonmarketable savings securities, and savings securities stock. Data are initially processed at FRBs and then forwarded to BPD’s Parkersburg, West Virginia, data center for further processing. The overall effectiveness of the BPD computer controls depends on the controls implemented by BPD’s Assistant Commissioner for the Office of Information Technology. This person serves as Chief Information Officer and is responsible for overseeing the development, implementation, and operation of information processing systems. Our objectives were to evaluate and test the effectiveness of the controls over key financial management systems maintained and operated by BPD. Specifically, we evaluated general controls intended to protect data, files, and programs from unauthorized access, modification, prevent the introduction of unauthorized changes to systems and ensure that system software development and maintenance, applications software development and maintenance, computer operations, security, and quality assurance are performed by different people; ensure recovery of computer processing operations in case of a disaster or other unexpected interruption; and ensure that an adequate computer security planning and management program is in place. To evaluate the general controls, we identified and reviewed BPD’s information system general control policies and procedures, conducted tests and observations of controls in operation, and held discussions with officials at the BPD data center to determine whether general controls were in place, adequately designed, and operating effectively. In addition, we attempted to obtain access to sensitive data and programs. These attempts, referred to as penetration testing, were performed with the knowledge and cooperation of BPD officials. To evaluate certain application controls, we tested two key BPD financial applications maintained and operated at the data center. Specifically, we evaluated application controls intended to ensure that access privileges establish individual accountability and proper segregation of duties, limit the processing privileges of individuals, and prevent and detect inappropriate or unauthorized activities; data are authorized, converted to an automated form, and entered into the application accurately, completely, and promptly; data are properly processed by the computer and files are updated correctly; and files and reports generated by the application (1) represent transactions that actually occur and (2) accurately reflect the results of processing, and reports are controlled and distributed to the authorized users. To assist in our evaluation and testing of general and application controls, we contracted with an independent public accounting firm. We determined the scope of our contractor’s audit work, monitored its progress, and reviewed related working papers to ensure that the resulting findings were adequately supported. During the course of our work, we communicated interim findings and recommended corrective actions to BPD officials who informed us of the steps they planned to take or had taken to address the vulnerabilities we identified. We performed follow-up work to assess the status of any corrective actions taken as of September 30, 1997. The results of the follow-up work were also communicated to BPD. We performed our work at the BPD data center in Parkersburg, West Virginia, from March 1997 through January 1998 in accordance with generally accepted government auditing standards. We requested oral comments on a draft of this report from the Secretary of the Treasury or his designee. On August 31, 1998, the Commissioner of the Bureau of the Public Debt provided us with oral comments, which are discussed in the “Agency Comments” section. Our review of general controls over BPD’s financial systems did not identify any weaknesses that placed BPD’s financial information at significant risk of being accessed, compromised, or destroyed. However, we found certain vulnerabilities that warrant management’s attention and action. Specifically, we found that BPD could improve its general controls by (1) strengthening logical access controls over the use of powerful system capabilities that can be used to access data and programs, (2) strengthening physical controls to further restrict and prevent unauthorized access, and (3) enhancing its service continuity and contingency plans. BPD could also improve its oversight and monitoring of computer security by ensuring that known security violations are investigated and resolved. A key control used by organizations to protect and control access to information maintained in their systems is the use of logical access controls. Logical access controls consist of safeguards, such as passwords, user IDs, and security software programs, that prevent unauthorized users from gaining access to computing resources and restrict the access of legitimate users to the specific systems, programs, and files that they need to conduct their work. BPD did not adequately control powerful system capabilities to prevent unauthorized changes to data and programs that could adversely affect the integrity and availability of the on-line systems environment. We also identified vulnerabilities in certain controls that detect unauthorized access to BPD’s systems. Another key control for safeguarding financial data and computer resources from internal and external threats is physical access controls, such as locks, guards, fences, and surveillance equipment. Our review at the data center found physical access control vulnerabilities could allow access to sensitive areas within the BPD data center by employees whose jobs did not warrant such access. An organization’s ability to respond to and maintain service after an emergency can be significantly affected by how well it has planned for such contingencies and tested those plans. An organizational contingency plan describes how an organization will deal with a full range of emergencies, from electrical power failures to catastrophic events, such as earthquakes, floods, and fires. The plan specifies the organization’s emergency response, backup operations, and postdisaster recovery procedures to ensure the availability of critical resources and facilitate the continuity of operations. It also identifies essential business functions and prioritizes resources in order of criticality. To be most effective, a contingency plan should be periodically tested, and employees should be trained in and familiar with its use. In reviewing BPD’s service continuity and contingency planning, we found vulnerabilities related to the close proximity of off-site storage, currentness and completeness of contingency plan testing, and adequacy of the backup power supply. In addition to establishing controls and preparing emergency response plans, an effective computer security management program requires that the organization be actively involved in planning and overseeing computer security activities. Such management involvement should include assigning explicit security responsibilities, regularly assessing risks, establishing and communicating security policies and procedures based on risks, and monitoring and periodically reviewing security controls. In reviewing general controls, we found security management vulnerabilities related to (1) “conflict of interest” issues in the reporting and follow-up of security violations and (2) verifying that background checks have been performed before granting employees access to systems. We also noted additional security management vulnerabilities related to the development of BPD-specific security policies and oversight of the security violation follow-up process. However, we verified that corrective actions resolving these vulnerabilities had been completed by BPD subsequent to September 30, 1997. In addition to testing general controls, we tested application controls for two key BPD financial applications maintained and operated at the BPD data center. We identified the following areas where improvements could be made: (1) strengthening access controls by further restricting system access rights and improving security monitoring and (2) managing accuracy controls more effectively by ensuring that established procedures are followed to prevent the unauthorized deletion of exception reports. Like general access controls, access controls for specific applications should be established to ensure individual accountability and proper segregation of duties, limit the processing privileges of individuals, and prevent and detect inappropriate or unauthorized activities. For the applications reviewed, we found that BPD granted greater access rights to users than required for their jobs, maintained inadequate documentation of access authorizations granted to users, and did not adequately monitor user activities relating to the applications. Accuracy controls are one of the processing controls used to ensure that data are valid and correctly processed. For one application, we determined that the automated controls for identifying and correcting exceptions need improvement. Specifically, established procedures were not followed to prevent inappropriate use of a powerful software utility to delete exception reports from production databases. The deletion of exception conditions may cause inaccuracies in the application’s reporting.