Increasing computer interconnectivity—most notably growth in the use of the Internet—has revolutionized the way that our government, our nation, and much of the world communicate and conduct business. While this interconnectivity offers us huge benefits, without proper safeguards it also poses significant risks to the government’s computer systems and, more importantly, to the critical operations and infrastructures they support. We reported in 2005 that while federal agencies showed improvement in addressing information security, they also continued to have significant control weaknesses in federal computer systems that put federal operations and assets at risk of inadvertent or deliberate misuse, financial information at risk of unauthorized modification or destruction, sensitive information at risk of inappropriate disclosure, and critical operations at the risk of disruption. The significance of these weaknesses led us to conclude in the audit of the federal government’s fiscal year 2005 financial statements that information security was a material weakness. Our audits also identified instances of similar types of weaknesses in non-financial systems. Enacted into law on December 17, 2002, as title III of the E- Government Act of 2002, FISMA authorized and strengthened information security program, evaluation, and reporting requirements. The Act assigns specific responsibilities to agency heads, chief information officers, and IGs. It also assigns responsibilities to OMB, which include developing and overseeing the implementation of policies, principles, standards, and guidelin on information security and reviewing at least annually, and approving or disapproving, agency information security programs. Overall, FISMA requires each agency (including agencies with national security systems) to develop, document, and implement an agencywide information security program. This program should provide security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. Specifically, this program is to include ● periodic assessments of the risk and magnitude of harm tha se, disclosure, could result from the unauthorized access, u disruption, modification, or destruction of information or information systems; risk-based policies and procedures that cost-effectively red information security risks to an acceptable level and ensure that information security is addressed throughout the life cycle of each information system, including minimally acceptable system configuration requirements; uce subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems; security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency; periodic evaluation of the effectiveness of information security policies, procedures, and practices, performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial action information security policies, procedures, and practice agency; to address any deficiencies in the procedures for detecting, reporting, and responding to security incidents; and ● plans and procedures to ensure continuity of operations for information systems that support the operations and assets of th agency. FISMA also established a requirement that each agency develop, maintain, and annually update an inventory of major information systems (including major national security systems) that are operated by the agency or under its control. This inventory is to include an identification of the interfaces between each system an all other systems or networks, including those not operated by o r under the control of the agency. Each agency is also required to have an annual independent evaluation of its information security program and practices, including control testing and compliance assessment. Evaluations of non-national security systems are to be performed by the agency IG or by an independent external auditor, while evaluations related to national security systems are to be performed only by an entity designated by the agency head. The agencies are to report annually to OMB, selected congressional committees, and the Comptroller General on the adequacy of information security policies, procedures, practices, and compliance with FISMA requirements. In addition, agency heads are required to make annual reports of the results of their independent evaluations to OMB. OMB must submit a report to Congress no later than March 1 of each year on agency compliance, including a summary of the findings of agencies’ independent evaluations. Other major provisions direct that the National Institute of Standards and Technology (NIST) develop, for systems other than national security systems: (1) standards to be used by all agencies to categorize all their information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels; (2) guidelines recommending the types of information and information systems to be included in each category; and (3) minimum information security requirements for information and information systems in each category. NIST must also develop a definition of and guidelines concerning detection and handling of information security incidents and guidelines. OMB provides instructions to the agencies and their IGs on the annual FISMA reporting requirements. OMB’s fiscal year 2005 reporting instructions, similar to the 2004 instructions, ha focus on performance measures. OMB has developed performan measures in the following areas: testing of security controls, ● agency systems and contractor systems reviewed annually, ● testing of contingency plans, incident reporting, ● annual security awareness training for employees and contractors, ● annual specialized training for ● minimally acceptable configuration requirements. Further, OMB has provided instructions for continued agency reporting on the statu action and milestones. Required for all programs an a weaknesses and show estimated resource needs or other challe to resolving them, key milestones and completion dates, and th status of corrective actions. The plans are to be submitted twice a year to OMB. In addition, agencies are to submit quarterly up dates that indicate the number of weaknesses for which corrective action has been completed as originally scheduled, or has been delayed, as well as the number of new weaknesses discovered since the last update. s of remediation efforts through plans of n IT security weakness has been found, these plans list the The annual IGs’ reports requested by OMB are to be based on the results of their independent evaluations, including work performed throughout the reporting period (such as work performed as part of the annual financial audits of the agencies). While OMB asked the IGs to respond to some of the same questions as the agencies, it al asked them to assess whether their agency had developed, implemented, and was managing an agencywide plan of actions and milestones. Further, OMB asked the IGs to assess the quality of the certification and accreditation process at their agencies, as well as the status of their agency’s inventory of major information systems. OMB did not request that the IGs validate agency responses to the performance measures. Instead, as part of their independent evaluations of a subset of agency systems, IGs were asked to assess the reliability of the data for those systems that they evaluated. In its March 2006 report to Congress on fiscal year 2005 FISMA implementation, OMB emphasized that the federal government has made progress in meeting key performance measures for IT security; however, uneven implementation of security efforts leaves weaknesses in several areas. OMB determined through its assessment of FISMA reports that advances have occurred at a governmentwide level in the following areas of IT security: ● Systems certification and accreditation. Agencies recorded a 19 percent increase in the total number of IT systems and reported that the percentage of certified and accredited systems rose from 77 percent in fiscal year 2004 to 85 percent in 2005. Moreover, OMB noted that 88 percent of systems assessed as high-risk have been certified and accredited. ● Assessed quality of the certification and accreditation process. OMB’s analysis of reports from the IGs revealed an increase in agencies with a certification process rated as “satisfactory” or higher, from 15 in 2004 to 17 in 2005. ● Plans of action and milestone process. OMB noted that out of 25 agencies that it reviewed in detail, 19 IGs report that their agencies have effective remediation processes, compared to 18 in 2004. In addition to these areas of improvement, OMB detected areas with continuing weaknesses: ● Contractor systems oversight. IGs for 6 of 24 agencies (one agency IG did not respond) rated agency oversight of contractor systems in the “rarely” range, while 3 others rated this oversight in the next lowest range, “sometimes.” ● Security controls testing. Agencies tested the security controls on a lower percentage of systems, dropping from 76 percent in fiscal year 2004 to 72 percent in 2005. OMB noted a better rate of testing for high-risk systems, with a governmentwide total of 83 percent. ● Incident reporting. OMB stated that some agencies continue to report security incidents to the Department of Homeland Security only sporadically and that others report notably low levels of incidents. ● Agencywide plans of action and milestones. While IGs for 19 agencies reported effective POA&M processes, 6 others reported ineffective processes. ● Certification and accreditation process. OMB commented that while no IG rated the certification and accreditation process for its agency as failing, eight rated the process as “poor.” The OMB report also discusses a plan of action to improve performance, assist agencies in their information security activities, and promote compliance with statutory and policy requirements. OMB has set a goal for agencies to have 90 percent of their systems certified and accredited and their certification and accreditation process rated as “satisfactory” or better by their IGs. In their FISMA-mandated reports for fiscal year 2005, the 24 major agencies reported both improvements and weaknesses in major performance indicators.