Dramatic increases in computer interconnectivity, especially in the use of the Internet, continue to revolutionize the way our government, our nation, and much of the world communicate and conduct business. However, this widespread interconnectivity also poses significant risks to our computer systems and, more important, to the critical operations and infrastructures they support, such as telecommunications, power distribution, public health, national defense (including the military’s warfighting capability), law enforcement, government, and emergency services. Likewise, the speed and accessibility that create the enormous benefits of the computer age, if not properly controlled, allow individuals and organizations to inexpensively eavesdrop on or interfere with these operations from remote locations for mischievous or malicious purposes, including fraud or sabotage. As greater amounts of money are transferred through computer systems, as more sensitive economic and commercial information is exchanged electronically, and as the nation’s defense and intelligence communities increasingly rely on commercially available information technology, the likelihood increases that information attacks will threaten vital national interests. Further, the events of September 11, 2001, underscored the need to protect America’s cyberspace against potentially disastrous cyber attacks—attacks that could also be coordinated to coincide with physical terrorist attacks to maximize the impact of both. Since September 1996, we have reported that poor information security is a widespread federal problem with potentially devastating consequences.Although agencies have taken steps to redesign and strengthen their information system security programs, our analyses of information security at major federal agencies have shown that federal systems were not being adequately protected from computer-based threats, even though these systems process, store, and transmit enormous amounts of sensitive data and are indispensable to many federal agency operations. In addition, in both 1998 and 2000, we analyzed audit results for 24 of the largest federal agencies and found that all 24 had significant information security weaknesses. As a result of these analyses, we have identified information security as a governmentwide high-risk issue in reports to the Congress since 1997—most recently in January 2001. To fully understand the significance of the weaknesses we identified, it is necessary to link them to the risks they present to federal operations and assets. Virtually all federal operations are supported by automated systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions and account for their resources without these information assets. Hence, the degree of risk caused by security weaknesses is extremely high. The weaknesses identified place a broad array of federal operations and assets at risk. For example, resources, such as federal payments and collections, could be lost or computer resources could be used for unauthorized purposes or to launch sensitive information, such as taxpayer data, social security records, medical records, and proprietary business information, could be inappropriately disclosed or browsed or copied for purposes of espionage or other types of crime; critical operations, such as those supporting national defense and emergency services, could be disrupted; data could be modified or destroyed for purposes of fraud or disruption; agency missions could be undermined by embarrassing incidents that result in diminished confidence in their ability to conduct operations and fulfill their fiduciary responsibilities. Concerned with accounts of attacks on commercial systems via the Internet and reports of significant weaknesses in federal computer systems that make them vulnerable to attack, on October 30, 2000, Congress enacted Government Information Security Reform provisions as part of the Floyd D. Spence National Defense Authorization Act for Fiscal Year 2001. These provisions became effective November 29, 2000, and are in effect for 2 years after this date. The reform provisions supplement information security requirements established in the Computer Security Act of 1987, the Paperwork Reduction Act of 1995, and the Clinger-Cohen Act of 1996 and are consistent with existing information security guidance issued by OMB and the National Institute of Standards and Technology (NIST), as well as audit and best practice guidance issued by GAO. Most importantly, however, the provisions consolidate these separate requirements and guidance into an overall framework for managing information security and establish new annual review, independent evaluation, and reporting requirements to help ensure agency implementation and both OMB and congressional oversight. The legislation assigned specific responsibilities to OMB, agency heads and CIOs, and the IGs. OMB is responsible for establishing and overseeing policies, standards and guidelines for information security. This includes the authority to approve agency information security programs, but delegates OMB’s responsibilities with regard to national security systems to national security agencies. OMB is also required to submit an annual report to the Congress summarizing results of agencies’ evaluations of their information security programs. The reform provisions do not specify a date for this report. Each agency, including national security agencies, is to establish an agencywide risk-based information security program to be overseen by the agency CIO and ensure that information security is practiced throughout the life cycle of each agency system. Specifically, this program is to include periodic risk assessments that consider internal and external threats to the integrity, confidentiality, and availability of systems, and to data supporting critical operations and assets; the development and implementation of risk-based, cost-effective policies and procedures to provide security protections for information collected or maintained by or for the agency; training on security responsibilities for information security personnel and on security awareness for agency personnel; periodic management testing and evaluation of the effectiveness of policies, procedures, controls, and techniques; a process for identifying and remediating any significant deficiencies; procedures for detecting, reporting and responding to security incidents; an annual program review by agency program officials. In addition to the responsibilities listed above, the reform provisions require each agency to have an annual independent evaluation of its information security program and practices, including control testing and compliance assessment. The evaluations of non-national-security systems are to be performed by the agency IG or an independent evaluator, and the results of these evaluations are to be reported to OMB. For the evaluation of national security systems, special provisions include designation of evaluators by national security agencies, restricted reporting of evaluation results, and an audit of the independent evaluation performed by the IG or an independent evaluator. For national security systems, only the results of each audit of an evaluation are to be reported to OMB. Finally, the reform provisions also assign additional responsibilities for information security policies, standards, guidance, training, and other functions to other agencies. These agencies are NIST, the Department of Defense, the Intelligence Community, the Attorney General, the General Services Administration (GSA), and the Office of Personnel Management. With oversight jurisdiction for information security, this subcommittee has continued to hold hearings on the status of information security in the federal government. Most recently, on November 9, 2001, the subcommittee issued information security “grades” based primarily on the agencies’ reform provision review summaries and IG evaluations that were submitted to OMB. The overall grade for the federal government was an “F.” The initial implementation of the reform provisions is a significant step in addressing the serious, pervasive weaknesses in the federal government’s information security. The legislation consolidates existing security requirements and adds new statutory requirements designed to improve information security, such as independent evaluations and annual reporting. In addition, implementation of the provisions has improved agency focus on information security and resulted in important actions by the administration. Although security requirements existed in law and policy before this law, the reform provisions put into law several important additional requirements. First, the provisions require a risk-based security management program covering all operations and assets of the agency and those provided or managed for the agency by others to be implemented by agency program managers and CIOs. Instituting such an approach is important since many agencies had not effectively evaluated their information security risks and implemented appropriate controls. Our studies of public and private best practices have shown that effective security program management requires implementing a process that provides for a cycle of risk management activities as now included in the reform provisions. Moreover, other efforts to improve agency information security will not be fully effective and lasting unless they are supported by a strong agencywide security management program. Second, the reform provisions require an annual independent evaluation of each agency’s information security program. Individually, as well as collectively, these evaluations can provide much needed information for improved oversight by OMB and the Congress. Our years of auditing agency security programs have shown that independent tests and evaluations are essential to verifying the effectiveness of computer-based controls. Audits can also evaluate agency implementation of management initiatives, thus promoting management accountability. Annual independent evaluations of agency information security programs will help drive reform because they will spotlight both the obstacles and progress toward improving information security and provide a means of measuring progress, much like the financial statement audits required by the Government Management Reform Act of 1994. Further, independent reviews proved to be an important mechanism for monitoring progress and uncovering problems that needed attention in the federal government’s efforts to meet the Year 2000 computing challenge. Third, the reform provisions take a governmentwide approach to information security by accommodating a wide range of information security needs and applying requirements to all agencies, including those engaged in national security. This is important because the information security needs of civilian agency operations and those of national security operations have converged in recent years. In the past, when sensitive information was more likely to be maintained on paper or in stand-alone computers, the main concern was data confidentiality, especially as it pertained to classified national security data. Now, virtually all agencies rely on interconnected computers to maintain information and carry out operations that are essential to their missions. While the confidentiality needs of these data vary, all agencies must be concerned about the integrity and the availability of their systems and data. It is important for all agencies to understand these various types of risks and take appropriate steps to manage them. Fourth, the annual reporting requirements provide a means for both OMB and the Congress to oversee the effectiveness of agency and government- wide information security, measure progress in improving information security, and consider information security in budget deliberations.