OPM collects and maintains personal information on millions of individuals, including sensitive security clearance data. The agency is the central human resources agency for the federal government, overseeing all policy to support federal agencies’ human resources departments— from classification and qualifications systems to pay, leave, and benefit policies. In addition, the agency provides investigative products and services for more than 100 federal agencies to use as the basis for suitability for employment and security clearance determinations. It also provides more than 95 percent of the government’s background investigations, conducting approximately 2.2 million investigations a year. The agency had a fiscal year 2016 discretionary budget authority of about $245 million and around 5,300 full-time equivalent employees. On June 4, 2015, OPM reported that a breach to its information technology systems and data had potentially compromised the personal information of about 4.2 million former and current federal employees. In July 2015, OPM reported that a separate but related cyber incident targeting its databases containing background investigation records was estimated to have compromised security clearance background information of about 21.5 million individuals. In the months that followed the breach, further investigation by the agency revealed that the information compromised as a result of these breaches included employee Social Security numbers, residency and education history, employment history, information about immediate family and other personal and business acquaintances, criminal and financial history, job assignments, performance ratings, training information, and the fingerprints of approximately 5.6 million individuals. An estimated 22.1 million individuals had some form of PII stolen, with 3.6 million being a victim of both breaches. OPM’s director is responsible for ensuring the adequacy of the agency’s information security program, including information security policies, procedures, and practices. The OPM Chief Information Officer (CIO) leads the development, management, operations, and support of the IT infrastructure, with the assistance of the managers and staff in OCIO. The agency’s Chief Information Security Officer (CISO) serves as the CIO’s primary information security adviser and guides the information security activities of the agency’s authorizing officials and information security officers. OPM also has a Management Review Board, which includes the CISO, Deputy CISO, and certain branch chiefs as members. This board is intended to manage information security risks by reviewing and approving the creation and closure actions associated with plans of action and milestones (POA&M), which address identified weaknesses. The Federal Information Security Modernization Act (FISMA) of 2014 is intended to provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets and for ensuring the effective oversight of information security risks, including those throughout civilian, national security, and law enforcement agencies. FISMA assigns responsibility to the head of each agency for providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency. The law also delegates to the agency CIO (or comparable official) the authority to ensure compliance with FISMA requirements. FISMA also requires each agency to develop, document, and implement an agency-wide information security program to provide risk-based protections for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. Such a program includes assessing risk; developing and implementing cost-effective security plans, policies, and procedures; developing plans for providing adequate information security for networks, facilities, and systems; providing security awareness and specialized training; testing and evaluating the effectiveness of controls; planning, implementing, evaluating, and documenting remedial actions to address information security deficiencies; developing and implementing procedures for detecting, reporting, and responding to security incidents; and ensuring continuity of operations. In addition, FISMA requires agencies to comply with NIST standards and the Office of Management and Budget (OMB) requires agencies to comply with NIST guidelines. Further, FISMA requires the operation of a central federal information security incident center, a role now filled by the DHS’s US-CERT. The mission of US-CERT is to strive for a safer, stronger Internet for all Americans by responding to major incidents, analyzing threats, and exchanging critical cybersecurity information with trusted partners around the world. This mission is reflected in the four critical activities it is responsible for carrying out: Providing cybersecurity protection to federal civilian executive branch agencies through intrusion detection and prevention capabilities. Developing timely and actionable information for distribution to federal departments and agencies; state, local, tribal, and territorial governments; critical infrastructure owners and operators; private industry; and international organizations. Some of the information currently distributed includes weekly vulnerability bulletins and technical alerts. Responding to incidents and analyzing data about emerging cyber threats. Collaborating with foreign governments and international entities to enhance the nation’s cybersecurity posture. US-CERT has developed programs and resources to carry out these activities, including the distribution of technical alerts, tips, and weekly vulnerability bulletins. In addition, it occasionally performs reviews at the agency and system levels, an activity that allows it to provide agencies more detailed information on agency- and/or system-specific weaknesses, vulnerabilities, and actions to remediate them. OMB has established various initiatives intended to protect federal systems. These include, but are not limited to, OMB’s 30-day Cybersecurity Sprint, the October 2015 CSIP, and the CAP Goals. Agency participation and compliance with these key initiatives, which are outlined in table 1, are mandatory. In August 2014, we issued a report that examined federal agency oversight of contractor-operated federal IT systems. We reported that OPM, one of six federal agencies reviewed, had generally established security and privacy requirements and had planned for assessments to determine the effectiveness of contractor implementation of controls. However, the system assessments performed were not always effective. We recommended that OPM improve its oversight of contractor testing to ensure that tests are being fully executed for all contractor-operated systems. According to OPM officials, efforts are underway to implement the recommendation. In May 2016, we reported on the implementation of OPM’s information security program and the security of selected high-impact systems. We reported that OPM, one of four agencies reviewed, had implemented numerous controls to protect selected systems, but access controls had not always been implemented effectively. Weaknesses also existed in patching known software vulnerabilities and planning for contingencies. An underlying reason for these weaknesses was that OPM had not fully implemented key elements of their information security program. We recommended that OPM fully implement key elements of its program, including addressing shortcomings related to its security plans, training, and system testing. According to OPM officials, the agency is in the process of taking actions to address these recommendations. In addition, we issued a restricted version of the May 2016 report that identified vulnerabilities specific to each of the two systems we reviewed and made recommendations to resolve access control weaknesses in those systems. In December 2016, OPM indicated its concurrence with the recommendations and provided time frames for implementing them. Since the 2015 data breaches, OPM has made progress in improving its security to prevent, mitigate, and respond to data breaches involving sensitive personal records and background investigations information. After breaches of personnel and background investigation information were reported, US-CERT worked with the agency to resolve issues and develop a comprehensive mitigation strategy. Toward this end, in September 2015, US-CERT made 19 recommendations to OPM to help the agency improve its overall security posture and, thus, improve its ability to protect its systems and information from security breaches. As of May 2017, OPM had fully implemented 11 of the recommendations. For the remaining 8 recommendations, actions for 4 were still in progress. For the other 4 recommendations, OPM indicated that it had completed actions to address them, but we noted further improvements were needed. Further, OPM had not validated actions taken to address the recommendations in a timely manner. Beyond actions associated with the US-CERT recommendations, OPM established a new organization—the National Background Investigation Bureau (NBIB)—to perform background investigation services. It signed a memorandum of agreement with the Department of Defense (DOD) to develop and secure new systems to support the bureau’s mission. OPM has made progress in implementing the 19 US-CERT recommendations, but has opportunities to improve on the actions it has taken. As shown in table 2 and subsequently discussed, the agency completed actions for 11 recommendations; needed to further improve on actions taken for 4 other recommendations it indicated had been completed; and needed to complete actions in progress for the remaining 4. Due to the sensitive nature of the recommendations, we are not providing the specific recommendations or specific examples associated with them. Generally, the recommendations pertained to strengthening activities and controls related to passwords, access permissions, patches, audit and monitoring, among other things. OMB requires agencies to create a POA&M to track efforts to remediate identified weaknesses, such as those leading to the 19 recommendations made by US-CERT. In addition, OPM’s policy requires that scheduled completion dates be included in the plan. The policy also requires a system’s Information System Security Officer (ISSO) to develop a weakness closure package containing evidence of how items in the POA&M have been remediated before the issue (recommendation in this case) can be closed. The policy further requires that the closure package be reviewed by the Management Review Board, which approves closure. Although OPM has a POA&M to address the 19 recommendations, it had not updated completion dates in the plan. The POA&M showed scheduled completion dates of either October or December 2015 for all recommendations. However, a separate recommendation tracking document provided to us indicated a planned completion date in the third quarter of 2017 for at least one recommendation.