Safeguarding government computer systems and sensitive information, including personally identifiable information (PII) that resides on them, is an ongoing challenge due to the complexity and interconnectivity of systems, the ease of obtaining and using hacking tools, the steady advances in the sophistication and effectiveness of attack technology, and the emergence of new and more destructive attacks. To help address this challenge, federal agencies, regardless of their size, must abide by federally mandated standards, guidelines, and requirements related to federal information systems. FISMA established a framework designed to ensure the effectiveness of security controls for information and information systems that support federal operations and assets. FISMA assigns specific responsibilities to (1) OMB, to develop and oversee the implementation of policies, principles, standards, and guidelines on information security (except with regard to national security systems); to report, at least annually, on agency compliance with the act; and to approve or disapprove agency information security programs; (2) agency heads, to provide information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency; (3) agency heads and chief information officers, to develop, document, and implement an agency-wide information security program; (4) inspectors general, to conduct annual independent evaluations of agency efforts to effectively implement information security; and (5) the National Institute of Standards and Technology (NIST), to develop standards and guidance to agencies on information security. More specifically, FISMA requires each agency to develop, document, and provide an information security program that includes the following components: periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; policies and procedures that (1) are based on risk assessments, (2) cost-effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements; subordinate plans for providing adequate information security for networks, facilities, and systems or group of information systems, as appropriate; security awareness training to inform personnel of information security risks and of their responsibilities in implementing agency policies and procedures, as well as training personnel with significant security responsibilities for information security; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. FISMA also gives OMB responsibility for ensuring the operation of a federal information security incident center. Established in 2003, the United States Computer Emergency Readiness Team (US-CERT) is the federal information security incident center mandated by FISMA. US- CERT consults with agencies on cyber incidents, provides technical information about threats and incidents, compiles the information, and publishes it on its website, https://www.us-cert.gov. In the 11 years since FISMA was enacted, executive branch oversight of agency information security has changed. As part of its FISMA oversight responsibilities, OMB has issued annual guidance to agencies on implementing FISMA requirements, including instructions for agency and inspector general reporting. However, in July 2010, the Director of OMB and the White House Cybersecurity Coordinator issued a joint memorandum stating that DHS was to exercise primary responsibility within the executive branch for the operational aspects of cybersecurity for federal information systems that fall within the scope of FISMA. The memorandum stated that DHS’s activities would include overseeing the government-wide and agency-specific implementation of and reporting on cybersecurity policies and guidance; overseeing and assisting government-wide and agency-specific efforts to provide adequate, risk-based, and cost-effective cybersecurity; overseeing the agencies’ compliance with FISMA and developing analyses for OMB to assist in the development of the FISMA annual report; overseeing the agencies’ cybersecurity operations and incident response and providing appropriate assistance; and annually reviewing the agencies’ cybersecurity programs. Within DHS, the Federal Network Resilience Office, within the National Protection and Programs Directorate, is responsible for (1) developing and disseminating most FISMA reporting metrics, (2) managing the CyberScope web-based application, and (3) collecting and reviewing federal agencies’ cybersecurity data submissions and monthly data feeds to CyberScope. In addition, the office is responsible for conducting cybersecurity reviews and assessments at federal agencies to evaluate the effectiveness of agencies’ information security programs. The primary laws that require privacy protections for personal information maintained, collected, used, or disseminated by federal agencies are the Privacy Act of 1974 and the E-Government Act of 2002. The Privacy Act places limitations on agencies’ collection, maintenance, disclosure, and use of PII maintained in systems of records, including requirements for each agency to (1) maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required by statute or by executive order of the President; (2) establish rules of conduct for persons involved in the design, development, operation, or maintenance of any system of records, or in maintaining any record, and instruct each such person in those rules and the requirements of the act; and (3) establish appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity that could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained. Additionally, when an agency establishes or makes changes to a system of records, it must notify the public through a system of records notice in the Federal Register that includes the categories of data collected, the categories of individuals about whom information is collected, the intended “routine” uses of data, and procedures that individuals can use to review and correct personally identifiable information. In addition, the E-Government Act of 2002 requires agencies to assess the impact of federal information systems on individuals’ privacy. Specifically, the E-Government Act strives to enhance the protection of personal information in government information systems by requiring that agencies conduct privacy impact assessments (PIA) for systems or collections containing personal information. According to OMB guidance, the purpose of a PIA is to (1) ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (2) determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system; and (3) examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. Small agencies provide a variety of services and manage a variety of federal programs. According to OMB, their responsibilities include issues concerning commerce, trade, energy, science, transportation, national security, finance, and culture. Approximately half of the small agencies in the federal government perform regulatory or enforcement roles in the executive branch. For example, the National Archives and Records Administration oversees the federal government’s recordkeeping and ensures preservation of and access to records. In addition, the Federal Reserve Board assists with implementing the monetary policy of the United States. The Federal Reserve Board also plays a major role in the supervision and regulation of the U.S. banking system. The remaining small federal agencies are largely grant-making, advisory, and uniquely chartered organizations. For example, the United States Institute of Peace is an independent, nonpartisan institution established and funded by Congress to increase the nation’s capacity to manage international conflict without violence. Together, small agencies employ about 90,000 federal workers and manage billions of taxpayer dollars. Similarly, the six selected agencies in our review provide a broad range of federal services (see table 1). Small federal agencies have reported a number of incidents that have placed sensitive information at risk, with potentially serious impacts on federal operations, assets, and people. According to DHS, the number of reported security incidents for small agencies from fiscal year 2009 to fiscal year 2013 ranged from 2,168 to 3,144. Incidents involving PII at small agencies increased from 258 in fiscal year 2009 to 664 in fiscal year 2013. In addition, in fiscal year 2013, small agencies reported 2,653 incidents to US-CERT. Table 2 describes the incident categories as defined by US-CERT. As shown in figure 1, the three most prevalent types of incidents reported by small agencies to US-CERT during fiscal year 2013 were those involving potentially malicious or anomalous activity (investigation), the execution or installation of malicious software (malicious code), and the violation of acceptable computing use policies (improper usage). Although the small agencies we reviewed have taken steps to develop information security and privacy programs, weaknesses existed that threatened the confidentiality, integrity, and availability of their information and systems. Regarding information security, these agencies did not fully or effectively develop, document, and implement security plans, policies, and procedures, as well as other elements of an information security program such as incident handling and contingency planning. A key reason for these weaknesses is that these small agencies have not yet fully implemented their agency-wide information security programs to ensure that controls are appropriately designed and operating effectively, and two of the six agencies did not develop an information security program that included any of the required FISMA elements. In addition, five of the six selected agencies had not fully implemented their privacy programs to ensure protection of PII.