Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business. It is especially important for government agencies, where the public’s trust is essential. The dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet are changing the way our government, the nation, and much of the world communicate and conduct business. Without proper safeguards, such interconnectivity also poses enormous risks that make it easier for individuals and groups with malicious intent to intrude into inadequately protected systems and use such access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. Protecting the computer systems that support critical operations and infrastructures has never been more important because of concerns about attacks from individuals and groups with such malicious intent, including terrorists. These concerns are well founded for a number of reasons, including the dramatic increases in reported computer security incidents, the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the dire warnings of new and more destructive cyber attacks to come. Computer-supported federal operations are likewise at risk. Our previous reports, and those of agency inspectors general, describe persistent computer security weaknesses that place a variety of critical federal operations, including those at FMS, at risk of disruption, fraud, and inappropriate disclosure. This body of audit evidence led us, in 1997, to designate computer security as a governmentwide high-risk area in reports to the Congress. It remains so today. How well federal agencies are addressing these risks is a topic of increasing interest in both the Congress and the executive branch. This is evidenced by recent hearings on information security and recent legislation intended to strengthen information security. In addition, the administration has taken other important actions to improve information security, such as integrating information security into the President’s Management Agenda Scorecard. Moreover, the Office of Management and Budget (OMB) and the National Institute of Standards and Technology (NIST) have issued security guidance to agencies. FMS is the bureau of the U.S. Department of the Treasury that serves as the federal government’s financial manager. Its mission is to provide central payment services to federal agencies, operate federal collection and deposit systems, manage delinquent debt owed to the federal government, and provide governmentwide accounting and reporting services. FMS processes about $3 trillion in collections and disbursements annually. To help it accomplish its mission, FMS maintains multiple financial and information systems to help it process and reconcile monies disbursed and collected by the various government agencies. These banking, collection, and disbursement systems are also used to process agency transactions, record relevant data, transfer funds to and from the Treasury, and facilitate the reconciliation of those transactions. In addition to its own data processing centers, FMS relies on contractors and the Federal Reserve to help carry out its financial management services. FMS’s Pay.gov is a governmentwide transaction portal that allows federal agencies to collect and the public to make several types of payments to the federal government via the Internet. Citizens and businesses remitting funds to the government for fees, fines, sales, leases, loan repayments, donations, and certain taxes can authorize Pay.gov to process an automated clearing house debit against their bank account or to authorize and settle a credit card transaction. In addition to collections, Pay.gov is to provide other electronic financial services over the Internet to assist federal agencies, such as (1) presenting agency bills to end users for collection and (2) accepting agency forms submitted by end users. Pay.gov is also to provide access control service that verifies an end user’s identity (authentication) and authorizes the end user’s allowed actions. Its reporting service provides information to the Treasury, agencies, and the public about transactions. Pay.gov is to support program needs of agencies and cash flow management for the Department of the Treasury. Critical information assets of this system include information provided by end users for authentication as well as form, bill, and collection data that are housed in Pay.gov’s databases and provided to the relevant agencies. According to FMS, the benefits of using Pay.gov include (1) increasing user convenience because electronic forms can be filed at any time, including outside of normal business hours, and (2) helping agencies meet their requirements under the Government Paperwork Elimination Act, which requires federal agencies to accept certain forms electronically by October 2003, when practicable as a substitute for paper. Although still early in its implementation, Pay.gov transaction volumes and amounts are expected to be significant. FMS has estimated that Pay.gov eventually could process about 80 million transactions and collect about $125 billion a year. According to FMS, during fiscal year 2002, Pay.gov collected about $1.5 billion in direct debit transactions. As of October 2002, Pay.gov was processing 20,000 direct debit transactions a month. Pay.gov is part of the Treasury Web Application Infrastructure (TWAI), a new Treasury hosting environment operated by the Federal Reserve. According to the Federal Reserve, TWAI is completely separate from its own payment systems and computing infrastructure. TWAI, referred to as the Pay.gov computing environment in this report, is designed to host multiple Treasury applications, of which Pay.gov is only one. It comprises a production or operating environment at one Federal Reserve facility and a test environment for testing and quality assurance services at another. In addition, a second production or operating environment is planned for the Pay.gov computing environment at a third Federal Reserve facility. The Assistant Commissioner, Federal Finance, is responsible for the federal government’s collection and deposit systems, including Pay.gov. A dedicated program manager oversees and manages the Pay.gov initiative for FMS. Responsibility for implementing and maintaining information technology security requirements for Pay.gov and its computing environment has been delegated to two information system security officers. Under the direction of FMS, several Federal Reserve facilities and their contractors operate Pay.gov and its computing environment and perform hosting, collection, and customer service functions. The objectives of our review were to determine whether FMS (1) conducted a comprehensive security risk assessment for Pay.gov and (2) documented and implemented appropriate security measures and controls for the system’s protection. To determine if a risk assessment was conducted for Pay.gov, we requested and examined risk assessment documents prepared for the Pay.gov application and computing environment. We also interviewed agency officials and reviewed risk assessment procedures. To guide our work for assessing Pay.gov security controls, we used the audit methodology described in our Federal Information System Controls Audit Manual, which discusses the scope of such reviews and the type of testing required for evaluating controls intended to limit, detect, and monitor electronic access to computer resources (data, programs, equipment, and facilities), thereby protecting these resources against unauthorized disclosure, modification, and use; ensure that work responsibilities are segregated so that one individual does not perform or control key aspects of computer-related operations and thereby have the ability to conduct unauthorized actions or gain unauthorized access to assets or records; prevent the implementation of unauthorized programs or modifications to an existing program; and minimize the risk of unplanned interruptions and recover critical computer processing operations if interruptions occur. To evaluate these controls, we reviewed system documentation, policies, and procedures; tested and observed controls in operation for the Pay.gov application and its computing environment located at three Federal Reserve facilities; and examined reports and other documents regarding security design and implementation. We also discussed with key security representatives, system administrators, and management officials whether computer-related controls were in place, adequately designed, and operating effectively. We performed our review at the Financial Management Service in Washington, D.C., three Federal Reserve facilities, and at our headquarters in Washington, D.C., from October 2002 through June 2003, in accordance with generally accepted government auditing standards. Understanding the risks associated with information systems is a key element of an information security program. Identifying and assessing information security risks help to determine what controls are required and what level of resources should be expended on controls. The Federal Information Security Management Act of 2002 and its predecessor, the Government Information Security Reform provisions, require all federal agencies to develop comprehensive information security programs based on assessing and managing risks. The February 1996 revision to OMB Circular A-130, Appendix III, Security of Federal Automated Information Resources, directs agencies to use a risk-based approach to determine adequate security, including a consideration of the major factors in risk management: the value of the system or application, threats, vulnerabilities, and the effectiveness of current or proposed safeguards. FMS assessed certain risks associated with the Pay.gov initiative; however, some key risks, including those relevant to the Pay.gov computing environment, were not sufficiently considered. FMS prepared a business risk assessment for the Pay.gov application in June 2002, about 9 months after Pay.gov’s initial release but just prior to the migration of the application from a private-sector service provider to the Federal Reserve. The assessment identified Pay.gov critical assets and the possible threats and vulnerabilities to those assets. Pay.gov stakeholders then assessed those threats, their associated vulnerabilities, and the consequences of the threats in order to prioritize and assign a risk level (for example, high, medium, or low) for each threat. Next, FMS identified and analyzed the existing controls and residual risks and then devised a plan of action to mitigate the risks to the Pay.gov application. However, FMS did not sufficiently assess the risk associated with the Pay.gov computing environment. This environment, which FMS defined as a general support system, provides the infrastructure for Treasury’s Web- based applications, including Pay.gov. FMS continued to host applications such as Pay.gov in this computing environment without taking necessary steps to identify and address potential threats to the system.