Our recent analyses of audit results for federal agencies showed improvement, but continued to show significant weaknesses in federal computer systems that put critical operations and assets at risk of inadvertent or deliberate misuse, financial information at risk of unauthorized modification or destruction, sensitive information at risk of inappropriate disclosure, and critical operations at risk of disruption. The significance of these weaknesses led GAO to recently conclude that information security was a material weakness in our audit of the federal government’s fiscal year 2003 financial statements. Audits also identified instances of similar types of weaknesses in non-financial systems, which continue to receive increased audit coverage in response to FISMA requirements. Weaknesses continued to be reported in each of the six major areas of general controls—the policies, procedures, and technical controls that apply to all or a large segment of an entity’s information systems and help ensure their proper operation. These six areas are (1) security program management, a principal focus of FISMA, which provides the framework for ensuring that risks are understood and that effective controls are selected and properly implemented; (2) access controls, which ensure that only authorized individuals can read, alter, or delete data; (3) software development and change controls, which ensure that only authorized software programs are implemented; (4) segregation of duties, which reduces the risk that one individual can independently perform inappropriate actions without detection; (5) operating systems controls, which protect sensitive programs that support multiple applications from tampering and misuse; and (6) service continuity, also addressed by FISMA, which ensures that computer-dependent operations experience no significant disruptions. To fully understand the significance of the weaknesses we identified, it is necessary to link them to the risks they present to federal operations and assets. Virtually all federal operations are supported by automated systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions and account for their resources without these information assets. Hence, the degree of risk caused by security weaknesses is extremely high. The weaknesses identified place a broad array of federal operations and assets at risk. For example, resources, such as federal payments and collections, could be lost or stolen; computer resources could be used for unauthorized purposes or to launch sensitive information, such as taxpayer data, social security records, medical records, and proprietary business information, could be inappropriately disclosed, browsed, or copied for purposes of espionage or other types of crime; critical operations, such as those supporting national defense and emergency services, could be disrupted; data could be modified or destroyed for purposes of fraud or disruption; agency missions could be undermined by embarrassing incidents that result in diminished confidence in their ability to conduct operations and fulfill their fiduciary responsibilities. Congress and the administration have established specific information security requirements in both law and policy to help protect the information and information systems that support these critical operations. On October 30, 2000, Congress passed GISRA, which was signed into law and became effective November 29, 2000, for a period of 2 years. GISRA supplemented information security requirements established in the Computer Security Act of 1987, the Paperwork Reduction Act of 1995, and the Clinger-Cohen Act of 1996 and was consistent with existing information security guidance issued by OMB and NIST, as well as audit and best practice guidance issued by GAO. Most importantly, however, GISRA consolidated these separate requirements and guidance into an overall framework for managing information security and established new annual review, independent evaluation, and reporting requirements to help ensure agency implementation and both OMB and congressional oversight. Enacted into law on December 17, 2002, as title III of the E-Government Act of 2002, FISMA permanently authorized and strengthened GISRA’s information security program, evaluation, and reporting requirements. Like GISRA, FISMA assigns specific responsibilities to agency heads, chief information officers (CIO), and IGs. It also assigns responsibilities to OMB, which include developing and overseeing the implementation of policies, principles, standards, and guidelines on information security; and reviewing at least annually, and approving or disapproving, agency information security programs. FISMA continues to delegate OMB responsibilities for national security systems to the Secretary of Defense and the Director of Central Intelligence. Overall, FISMA requires each agency, including agencies with national security systems, to develop, document, and implement an agencywide information security program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. Specifically, this program is to include periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; risk-based policies and procedures that cost-effectively reduce information security risks to an acceptable level and ensure that information security is addressed throughout the life cycle of each information system; subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems; security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security incidents; plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. FISMA also established a requirement that each agency develop, maintain, and annually update an inventory of major information systems (including major national security systems) operated by the agency or under its control. This inventory is to include an identification of the interfaces between each system and all other systems or networks, including those not operated by or under the control of the agency. The law also requires an agency’s CIO to designate a senior agency information security officer who, for the agency’s FISMA-prescribed information security responsibilities, shall carry out the CIO’s responsibilities; possess professional qualifications, including training and experience, required to administer the required functions; have information security duties as that official’s primary duty; and head an office with the mission and resources to assist in ensuring agency compliance. Under FISMA, each agency must continue to have an annual independent evaluation of its information security program and practices, including control testing and compliance assessment. Evaluations of non-national- security systems are to be performed by the agency IG or by an independent external auditor, while evaluations related to national security systems are to be performed only by an entity designated by the agency head. FISMA requires each agency to report annually to OMB, selected congressional committees, and the Comptroller General on the adequacy of information security policies, procedures, and practices, and compliance with FISMA’s requirements. In addition, agency heads are required to annually report the results of their independent evaluations to OMB, except that to the extent an evaluation pertains to a national security system, only a summary and assessment of that portion of the evaluation is reported to OMB. OMB is also required to submit a report to the Congress no later than March 1 of each year on agency compliance with FISMA’s requirements, including a summary of findings of agencies’ independent evaluations. FISMA also requires the Comptroller General to periodically evaluate and report to Congress on (1) the adequacy and effectiveness of agency information security policies and practices and (2) implementation of FISMA requirements. Other major FISMA provisions require NIST to develop, for systems other than national security systems, (1) standards to be used by all agencies to categorize all their information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels; (2) guidelines recommending the types of information and information systems to be included in each category; and (3) minimum information security requirements for information and information systems in each category. NIST must also develop a definition of and guidelines concerning detection and handling of information security incidents; and guidelines, developed in conjunction with the Department of Defense and the National Security Agency, for identifying an information system as a national security system. The law also assigned other information security functions to NIST, including providing technical assistance to agencies on such elements as compliance with the standards and guidelines and the detection and handling of information security incidents; conducting research, as needed, to determine the nature and extent of information security vulnerabilities and techniques for providing cost- effective information security; developing and periodically revising performance indicators and measures for agency information security policies and practices; evaluating private-sector information security policies and practices and commercially available information technologies to assess potential application by agencies; evaluating security policies and practices developed for national security systems to assess their potential application by agencies; and periodically assessing the effectiveness of and revising, as appropriate, the NIST standards and guidelines developed under FISMA. NIST is required to prepare an annual public report on activities undertaken in the previous year, and planned for the coming year, to carry out its responsibilities under FISMA. On August 6, 2003, OMB issued its fiscal year 2003 FISMA reporting instructions and guidance on quarterly IT security reporting. These instructions, which required agencies to submit their reports to OMB by September 22, 2003, essentially continued many of the reporting requirements established for GISRA, including performance measures introduced for fiscal year 2002 reporting under that law. The instructions also highlighted the more substantive changes introduced by FISMA.