FDIC was created by Congress to maintain the stability of and public confidence in the nation’s financial system by insuring deposits, examining and supervising financial institutions, and resolving troubled institutions. Congress created FDIC in 1933 in response to the thousands of bank failures that had occurred throughout the late 1920s and early 1930s. FDIC identifies, monitors, and addresses risks to the Deposit Insurance Fund when a bank or thrift institution fails. The Bank Insurance Fund and the Savings Association Insurance Fund were established as FDIC responsibilities under the Financial Institutions Reform, Recovery, and Enforcement Act of 1989, which sought to reform, recapitalize, and consolidate the federal deposit insurance system. The act also designated FDIC as the administrator of the Federal Savings and Loan Insurance Corporation Resolution Fund, which was created to close out the business of the former Federal Savings and Loan Insurance Corporation and liquidate the assets and liabilities transferred from the former Resolution Trust Corporation. The Bank Insurance Fund and the Savings Association Insurance Fund merged into the Deposit Insurance Fund on February 8, 2006, as a result of the passage of the Federal Deposit Insurance Reform Act of 2005. FDIC relies extensively on computerized systems to support its mission, including financial operations, and to store the sensitive information that it collects. The corporation uses local and wide area networks to interconnect its systems and a layered approach to information security defense. To support its financial management functions, FDIC uses, among others, the following IT resources: a corporate-wide system that functions as a unified set of financial and payroll systems that are managed and operated in an integrated fashion; a system to calculate and collect FDIC deposit insurance premiums and Financing Corporation interest amounts from insured institutions; a Web-based application that provides full functionality to support franchise marketing, asset marketing, and asset management; an application and Web portal to provide acquiring institutions with a secure method for submitting required data files to FDIC; computer programs used to derive the corporation’s estimate of losses from shared loss agreements; a system to request access to and receive permission for the computer applications and resources available to its employees, contractors, and other authorized personnel; and a primary receivership and subsidiary financial processing and reporting system. The federal government has seen a marked increase in the number of information security incidents affecting the integrity, confidentiality, and availability of government information, systems, and services. Without proper safeguards, computer systems are vulnerable to individuals and groups with malicious intentions who can intrude and use their access to obtain sensitive information, commit fraud and identity theft, disrupt operations, or launch attacks against other computer systems and networks. Cyber-based threats to information systems and cyber-related critical infrastructure can come from sources internal and external to the organization. External threats include the ever-growing number of cyber- based attacks that can come from a variety of sources such as individuals, groups, and countries who wish to do harm to an organization’s systems. Internal threats include errors or mistakes, as well as fraudulent or malevolent acts by employees or contractors working within an organization. Recent security incidents at FDIC highlight these threats. In May 2016, FDIC’s Chief Information Officer (CIO) testified about separate incidents involving the removal of personally identifiable information and other sensitive information by FDIC personnel using portable media shortly before their separation from the corporation. It was the CIO’s initial judgment that these incidents did not rise to the level of “major incident” as defined in the OMB guidance. However, the Office of Inspector General (OIG) reviewed one of these incidents and came to a different conclusion. The OIG, in a memorandum dated February 19, 2016, recommended that the incident they reviewed be reported to Congress under the category of “major incident.” Subsequently, the corporation elevated the incident to a “major incident” and reported this to Congress 7 days later. Under the Federal Information Security Modernization Act of 2014 (FISMA), the Chairman of FDIC is responsible for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the corporation’s CIO the authority to ensure compliance with the requirements imposed on the agency under FISMA. The CIO is responsible for developing and maintaining a corporate-wide information security program and for developing and maintaining information security policies, procedures, and control techniques that address all applicable requirements. The CIO also serves as the authorizing official with the authority to approve the operation of the information systems at an acceptable level of risk to the corporation. The Chief Information Security Officer reports to the CIO and serves as his designated representative. According to the corporation’s policy, Chief Information Security Officer is responsible for (1) the overall support of assessment and authorization activities; (2) the development, coordination, and implementation of FDIC’s security policy; and (3) the coordination of information security and privacy efforts across the corporation. Although FDIC has designed and documented numerous information security controls intended to protect its key financial systems and data, several of these information security controls were not consistently documented or implemented. Additionally, FDIC developed and documented many elements of its information security program. However, the corporation did not always consistently implement key information security program activities. By mitigating known information security weaknesses and ensuring that information security controls are consistently applied, FDIC could continue to reduce risks and better protect its sensitive financial information and resources from inadvertent or deliberate misuse, improper modification, unauthorized disclosure, or destruction. An agency can better protect the resources that support its critical operations and assets from unauthorized access, disclosure, modification, or loss by designing and implementing controls for identifying and authenticating users, restricting user access to only those users with a business need, encrypting sensitive data, auditing and monitoring systems to detect potentially malicious activity, managing and controlling system configurations, and conducting employee background investigations, among other things. Although FDIC had implemented numerous controls in these areas, weaknesses continue to challenge the corporation in ensuring the confidentiality, integrity, and availability of its information and information systems. Information systems need to effectively control user accounts and identify and authenticate users. Users and devices should be appropriately identified and authenticated through the implementation of adequate logical access controls. Users can be authenticated using mechanisms such as a password and user identification combination. National Institute of Standards and Technology (NIST) guidance recommends that agency information systems enforce minimum password complexity requirements. Accordingly, FDIC policy requires passwords to be at least eight characters in length. FDIC improved controls for identifying and authenticating the identity of users by implementing its policy on password controls over the Portfolio Investment Accounting (PORTIA) application. As a result, FDIC has reduced its risk that passwords could potentially be compromised and used to gain unauthorized access to financial information in the application. Authorization encompasses access privileges granted to a user, program, or process. It is used to allow or prevent actions by that user based on predefined rules. Authorization includes the principles of legitimate use and least privilege. NIST SP 800-53, revision 4 recommends that organizations employ the principle of least privilege by allowing only authorized users (or processes acting on behalf of users) access permission that is necessary to accomplish assigned tasks in accordance with organizational missions and business functions; periodically review the privileges assigned to users to validate the need for such privileges, and reassign or remove privileges when necessary; and disable access to information systems within a defined period when individuals are terminated. Consistent with NIST guidance, FDIC policy states that access to IT resources shall be terminated after an employee or contractor exits the FDIC and that periodic reviews of access settings shall be conducted to ensure that appropriate controls remain consistent with existing authorizations and current business needs. During 2015, FDIC improved controls for authorizing users’ access. For example, FDIC had implemented policies and procedures to ensure that network access is removed in a timely manner when a user is separated from FDIC, procedures to document reviews of user access to a system supporting the marketing of failed banks, and procedures to ensure that all user accounts are included in the periodic reviews of user access to resources supporting financial processing. Although FDIC strengthened authorization controls by implementing most of the unresolved recommendations, the corporation did not have an effective process for performing periodic reviews of user access rights for several systems supporting the corporation’s financial processing, consistently disable accounts belonging to users who had not accessed a financial system in a predefined period of time, consistently document that modifications to user access to systems had been authorized before making the changes, and identify authorization and recertification deficiencies during its oversight of an outsourced system. While these weaknesses did not materially impact FDIC’s financial statements, they nevertheless increase the risk that individuals may have greater access to financial data or to assets supporting financial processing than they need to fulfill their responsibilities. Cryptography controls can be used to help protect the integrity and confidentiality of data and computer programs by rendering data unintelligible to unauthorized users and/or protecting the integrity of transmitted or stored data. Cryptography involves the use of mathematical functions called algorithms and strings of seemingly random bits called keys to, among other things, encrypt a message or file so that it is unintelligible to those who do not have the secret key needed to decrypt it, thus keeping the contents of the message or file confidential. NIST guidance states that the use of encryption by organizations can reduce the probability of unauthorized disclosure of information. NIST also states that organizations should use cryptography to prevent unauthorized disclosure of information during transmission and encrypt passwords in storage and in transmission. The NIST standard for an encryption algorithm is Federal Information Processing Standards Publication (FIPS Pub.) 140-2. While FDIC established a project plan for implementing encryption, it had not implemented and used FIPS-compliant encryption for all mainframe connections.