With over 235,000 employees, including physicians, nurses, counselors, statisticians, computer specialists, architects, and attorneys, VA is the second largest federal department. It carries out its mission through three agency organizations—Veterans Health Administration (VHA), Veterans Benefits Administration (VBA), and National Cemetery Administration— and field facilities throughout the United States. The department provides services and benefits through a nationwide network of 156 hospitals, 877 outpatient clinics, 136 nursing homes, 43 residential rehabilitation treatment programs, 207 readjustment counseling centers, 57 veterans’ benefits regional offices, and 122 national cemeteries. In carrying out its mission, the department depends on IT and telecommunications systems, which process and store sensitive information, including personal information on veterans. Information security is a critical consideration for any organization that depends on information systems and networks to carry out its mission or business. It is especially important for government agencies, where maintaining the public’s trust is essential. The dramatic expansion in computer interconnectivity and the expanding use of mobile devices and storage media are changing the way our government, the nation, and much of the world share information and conduct business. Without proper safeguards, enormous risk exists that systems, mobile devices, and information are exposed to potential data tampering, disruptions in critical operations, fraud, and the inappropriate disclosure of sensitive information. Recognizing the importance of securing federal systems and data, Congress passed the Federal Information Security Management Act (FISMA) in December 2002, which permanently authorized and strengthened the information security program, evaluation, and reporting requirements established by earlier legislation (commonly known as GISRA, the Government Information Security Reform Act). FISMA sets forth a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. The act requires each agency to develop, document, and implement an agencywide information security program for the data and systems that support the operations and assets of the agency, using a risk-based approach to information security management. According to FISMA, the head of each agency has responsibility for delegating to the agency chief information officer (CIO) the authority to ensure compliance with the security requirements in the act. To carry out the CIO’s responsibilities in the area, a senior agency official is to be designated chief information security officer (CISO). In June 2002, we reported that VA had not completed actions to strengthen its security management program, ensure compliance with security policies and procedures, and ensure accountability for information security throughout the department. We made four recommendations to VA: (1) complete a comprehensive security management program that included actions related to central security management functions, risk assessments, security policies and procedures, security awareness, and monitoring and evaluating computer controls; (2) develop a process for managing the department’s updated security plan to remediate identified weaknesses; (3) regularly report to the Secretary, or his designee, on progress in implementing VA’s security plan; and (4) ensure consistent use of information security performance standards when appraising the department’s senior executives. Since our report in 2002, VA’s IG has made additional recommendations addressing serious weaknesses within the department’s information security controls. In March 2005, the VA IG reported that the department had not appropriately restricted access to data, ensured that only authorized changes were made to computer programs, ensured that backup and recovery plans were adequate to ensure the continuity of essential operations, and moved the VA Central Office data center to a more appropriate location. The IG made a number of recommendations to the department to secure patient information and data over VA networks, improve application and operating system change controls, test continuity of operations plans at national data centers, and complete the move of the VA Central Office data center. In its annual FISMA report for fiscal year 2005, issued in September 2006, the IG carried forward all the recommendations from its prior years’ FISMA audits. It made recommendations in 17 areas to address all FISMA related findings for the fiscal year. On May 3, 2006, the home of a VA employee was burglarized, resulting in the theft of a personally owned laptop computer and external hard drive that contained personal information on approximately 26.5 million veterans and U.S. military personnel. The external hard drive was not encrypted or password protected. The Secretary of VA was notified of the theft on May 16, 2006, and Congress and veterans were notified on May 22, 2006. Notification letters were sent to all veterans, and VA announced that free credit monitoring services would be offered. A number of congressional hearings were held and bills introduced related to the protection of veterans’ privacy and identity. During this time period, many veteran service organizations expressed concerns to Congress as to whether VA was capable of safeguarding the personal information of veterans. These organizations also expressed doubt over whether the department’s attempts to correct the weaknesses would be effective. The stolen computer equipment was recovered on June 28, 2006, and forensic testing by the Federal Bureau of Investigation determined that the sensitive data files had not been accessed or compromised. After the equipment was recovered, the Office of Management and Budget (OMB) withdrew its request to Congress for funding for the free credit monitoring services because it had concluded that credit monitoring services were no longer necessary due to the results of the FBI’s analysis. Veterans’ organizations indicated that the department should continue to offer credit monitoring services in order to allay veterans’ worries regarding the potential of identity theft. As a result of the theft, the VA IG issued a report in July 2006 on the investigation of the incident and made five recommendations to improve VA’s policies and procedures for securing sensitive information and conducting security awareness training. Recognizing the concerns of veterans, in December 2006, Congress passed the Veterans Benefits, Health Care, and Information Technology Act of 2006. Under the act, the VA’s CIO is responsible for establishing, maintaining, and monitoring departmentwide information security policies, procedures, control techniques, training, and inspection requirements as elements of the departmental information security program. The act also includes provisions to further protect veterans and service members from the misuse of their sensitive personal information. In the event of a security incident involving personal information, VA is required to conduct a risk analysis, and on the basis of the potential for compromise of personal information, the department may provide security incident notifications, fraud alerts, credit monitoring services, and identity theft insurance. Congress is to be informed regarding security incidents involving the loss of personal information. On January 22, 2007, a security incident at a research facility in Birmingham, Alabama, highlighted other potential risks associated with the loss of information. The incident involved the loss of information on 1.3 million medical providers from the Centers for Medicare & Medicaid Services of the Department of Health and Human Services, as well as information on 535,000 individuals. In its report on the Birmingham incident, the VA IG noted that the information compromised in the incident could potentially be used to compromise the identity of physicians and other health care providers and commit Medicare billing fraud. VA took action to respond to the loss of provider information by requesting the Department of Health and Human Services to conduct an independent risk analysis on the provider data loss. The risk analysis concluded that there was a high risk that the loss of personal information could result in harm to the individuals concerned, and the Centers for Medicare & Medicaid Services sent a letter to VA on March 28, 2007, requesting that credit monitoring services be offered to providers. The department mailed notification letters to providers starting on April 17, 2007, and offered credit monitoring services. In addition, the Centers for Medicare & Medicaid Services indicated that VA might need to take additional measures to mitigate any risk of further harm, but it did not specify what such action might be or specifically mention Medicare fraud. Although VA has made progress, it has not yet fully or effectively implemented two of four GAO recommendations and has not fully implemented 20 of 22 IG recommendations to strengthen its information security practices. Because these recommendations have not yet been implemented, unnecessary risk exists that personal information of veterans and others would be exposed to data tampering, fraud, and inappropriate disclosure. VA has implemented two of our recommendations. However, it has not fully implemented two other GAO recommendations. In response to our recommendation that it regularly report on progress in updating its security plan to the Secretary, the department CIO took immediate steps in 2002 to begin briefing the Secretary and Deputy Secretary on a regular basis. Regarding our recommendation that it develop a process for managing its remedial action plan, VA issued, in May 2006, its IT Directive 06-1, which established the Data Security-Assessment and Strengthening of Controls Program to remedy weaknesses in managing its action plan. It also hired a contractor to develop Web-based tools to assist department officials in managing and updating the plan on a biweekly basis. However, it has not fully implemented our remaining two recommendations. First, although it has taken action, VA has not yet fully implemented our recommendation to complete a comprehensive security management program, including actions related to central management functions, security policies and procedures, risk assessments, security awareness, and monitoring and evaluating computer controls. In August 2006, VA issued Directive 6500, which documented a framework for the department’s security management program and set forth roles and responsibilities for the Secretary, CIO, and CISO to ensure compliance with FISMA requirements. VA also developed, documented, and implemented security policies and procedures for certain central management functions and security awareness training. In addition, it implemented a process for tracking the status of security weaknesses and analyzing the results of computer security reviews using software tools the department had developed. As part of implementing the department’s security directive (Directive 6500), VA planned to issue Handbook 6500 to provide guidance for developing, documenting, and implementing the elements of the information security program. However, it has not finalized and approved this handbook, which has been in draft form since March 2005.