The use of IT is pervasive in the federal government as agencies have become dependent on computerized information systems and electronic data to carry out operations and to process, maintain, and report information. As our past work has shown, protecting federal systems and the information on them is essential because the loss or unauthorized disclosure or alteration of the information can lead to serious consequences and can result in substantial harm to individuals and the federal government. Specifically, ineffective protection of IT systems and information can result in threats to national security, economic well-being, and public health and safety; loss or theft of resources, including money and intellectual property; inappropriate access to and disclosure, modification, or destruction of sensitive information; use of computer resources for unauthorized purposes or to launch an attack on other computer systems; damage to networks and equipment; loss of public confidence; and high costs for remediation. While some incidents can be resolved quickly and at minimal cost, others may go unresolved and result in significant costs. Federal agencies rely extensively on contractors to provide IT services and operate systems to help carry out their missions. For example, we reported that in fiscal year 2012, the Department of Defense obligated approximately $360 billion for contracts for goods and services, such as information technology and weapon systems maintenance. The ability to contract for technology services can allow an agency to obtain or offer enhanced services without the cost of owning the required technology or maintaining the human capital required to deploy and operate it. Specifically, contractors and their employees provide services and systems to agencies at agency and contractor facilities, directly and by remote access. Services can include computer and telecommunication systems and services, and testing, quality control, installation, and operation of computer equipment. Federal laws require agencies to protect the privacy and security of federal data and information systems. To help protect against threats to federal systems, FISMA sets forth a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets, including those operated by contractors on behalf of the agency. It requires each agency to develop, document, and implement an information security program that includes the following components: periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; policies and procedures that are (1) are based on risk assessments, (2) cost-effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements; subordinate plans for providing adequate information security for networks, facilities, and systems or group of information systems, as appropriate; security awareness training to inform personnel, including contractors, of information security risks and of their responsibilities in complying with agency policies and procedures designed to reduce these risks, as well as training personnel with significant security responsibilities for information security; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of information systems; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. Under FISMA, each agency CIO has the responsibility to ensure that agency information and information systems, including those operated by contractors, are being protected under the agency’s information security program. In addition, OMB’s annual FISMA reporting instructions require agencies to develop policies and procedures for agency officials to follow when performing oversight of the implementation of security and privacy controls by contractors. FISMA requires each agency to have an annual independent evaluation of its information security program and practices, including controls testing and compliance assessment. OMB guidance specifically requires each agency inspector general, or other independent auditor, to perform the evaluation, including the effectiveness of the agency’s contractor oversight. Additionally, inspectors general are to evaluate agency efforts in providing oversight of contractor employees who have privileged access to federal data and information systems. In addition to establishing responsibilities for agencies, FISMA assigns specific information security responsibilities to OMB and NIST: OMB is to develop and oversee the implementation of policies, principles, standards, and guidelines on information security in federal agencies. It is also responsible for reviewing, at least annually, and approving or disapproving agency information security programs. Further, OMB is to report annually to Congress on the implementation of FISMA by the agencies. NIST’s responsibilities include developing security standards and guidelines for agencies (other than for national security systems) that include standards for categorizing information and information systems according to ranges of risk levels, minimum security requirements for information and information systems in risk categories, guidelines for detection and handling of information security incidents, and guidelines for identifying an information system as a national security system. The Privacy Act of 1974 limits how federal agencies collect, disclose, or use personal information. Under this act, agencies are to, among other things, establish appropriate safeguards to ensure the security and confidentiality of personal information maintained in a system of records and protect it against anticipated security or integrity threats or hazards. The Privacy Act’s requirements also apply to government contractors and contractor employees who have access to or maintain agency systems of records that contain personally identifiable information. The Privacy Act requires that when agencies establish or make changes to a system of records, they must notify the public through a system-of-records notice in the Federal Register which includes the system safeguards for the security and confidentiality of personal information. Pub. L. No. 107-347 § 208 (Dec. 17, 2002); 44 U.S.C. § 3501 note. agencies must conduct PIAs before developing or procuring information technology that collects, maintains, or disseminates information that is in a personally identifiable form. In conducting PIAs, agencies are to ensure that the handling of the information conforms to applicable privacy legal requirements, determine risks, and examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. To ensure that contractor-operated systems meet federal information security and privacy requirements, the Federal Acquisition Regulation (FAR) requires that agency acquisition planning for IT comply with the information technology security requirements in FISMA, OMB’s implementing policies including Appendix III of OMB Circular A-130, and NIST guidance and standards. The FAR addresses application of the Privacy Act to contractors at subpart 24.1, Protection of Individual Privacy. NIST Special Publications 800-53 and 800-53A guide agencies in selecting security and privacy controls for systems and assessing them to ensure that the selected controls are in place and functioning as expected. Additional NIST special publications on IT security services and risk management (Special Publications 800-35 and 800-37) identify several key activities important to contractor oversight for assessing the security and privacy controls of information systems. The key activities and the steps included in each are shown in table 3. The FAR establishes uniform policies and procedures for acquisition of supplies and services by executive agencies. The FAR and agency supplements are codified in title 48 of the Code of Federal Regulations. As relevant here, the FAR’s acquisition planning requirements for IT security are at 48 C.F.R. § 7.103(w). See also, FAR § 7.105(b)(16)(Government-furnished information) and (18)(Security considerations). NIST Special Publication 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, (Gaithersburg, MD: Apr. 2013) and NIST Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, (Gaithersburg, MD: Jun. 2010). In April 2005, we reported on federal agencies’ implementation of FISMA requirements and their oversight of contractors and others with privileged access to federal data and systems. We determined that, although most agencies reported having written policies that addressed information security for contractor-provided IT services and systems, few had established specific policies for overseeing the information security practices of contractors and contractor employees to ensure compliance with contract requirements and agency information security policies. We concluded that, without specific oversight policies establishing when and how agencies will review contractor-operated systems, officials responsible for the systems may not be taking sufficient action to ensure that security requirements are being met. We recommended, among other things, that the Director of OMB ensure that federal agencies develop policies for ensuring the information security of contractors and other users with privileged access to federal data. Subsequently OMB modified its instructions to better ensure that federal agencies develop policies for ensuring the information security provided by contractor employees. Under FISMA, each agency CIO has the responsibility to ensure that agency information and information systems, including those operated by contractors, are being protected under the agency’s information security program. In addition, OMB’s annual FISMA reporting instructions require agencies to develop policies and procedures for agency officials to follow when performing oversight of the implementation of security and privacy controls by contractors. CIO oversight of the agency’s information security program provides agency officials assurance that they are protecting sensitive agency information. According to NIST, assessment of security and privacy controls is a key element of security program oversight. While the six agencies we reviewed generally established security and privacy requirements for contractors to follow and prepared for assessments to determine the effectiveness of contractor implementation of controls, five of the six were inconsistent in overseeing the execution and review of those assessments. Table 4 details the degree of implementation of oversight activities for the selected systems at each agency. While agencies performed two of the eight key steps in all cases, most were inconsistent in performing the remaining steps for the oversight of the selected contractor-operated systems. Specifically: Communicate requirements to contractors.