The dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet are changing the way our government, the nation, and much of the world communicate and conduct business. Because of the concern about attacks from individuals and groups, protecting the computer systems that support critical operations and infrastructures has never been more important. These concerns are well founded for a number of reasons, such as escalating threats of computer security incidents, the ease of obtaining and using hacking tools, the steady advances in the sophistication and effectiveness of attack technology, and the emergence of new and more destructive attacks. According to experts from government and industry, during the first quarter of 2005, more than 600 new Internet security vulnerabilities were discovered, thereby placing organizations that use the Internet at risk. Computer-supported federal operations are likewise at risk. IBM recently reported that there were over 54 million attacks against government computers from January 2005 to June 2005. Without proper safeguards, there is risk that individuals and groups with malicious intent may intrude into inadequately protected systems and use this access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. How well federal agencies are addressing these risks is a topic of increasing interest in both Congress and the executive branch. This is evidenced by recent hearings on information security intended to strengthen information security. DLA is an agency of the Department of Defense (DOD). As DOD’s supply chain manager, DLA provides food, fuel, medical supplies, clothing, spare parts for weapon systems, and construction materials to sustain DOD military operations and combat readiness. To fulfill its mission, DLA relies extensively on interconnected computer systems to perform various functions, such as managing about 5.2 million supply items and processing about 54,000 requisition actions per day for goods and services. DLA employs about 22,575 civilian and military workers, located at about 500 field locations in 48 states and 28 countries. In accordance with DOD policy, DLA has developed an agencywide information security program to provide information security for its operations and assets. The DLA Director is responsible for ensuring the security of the information and information systems that support the agency’s operations. In carrying out this responsibility, the Director has delegated to DLA’s chief information officer the authority to ensure that the agency complies with FISMA and with other information security requirements. DLA’s chief information officer has also designated a senior agency official to serve as Director of Information Assurance—the agency’s senior information security officer—and to head the central security management group, commonly referred to as the information assurance program office. This group carries out specific responsibilities, including the following: documenting and maintaining an agencywide security framework to assess the agency’s security posture, identify vulnerabilities, and allocate resources; establishing and managing security awareness and specialized professional security training for employees who have significant security responsibilities; ensuring that all systems are certified and accredited in accordance with both federal and DOD processes; providing personnel at headquarters and the DLA locations with guidance on, and assistance in preparing, system security authorization agreements—single source data packages for all information pertaining to the certification and accreditation of a system in order to, among other things, guide actions, document decisions, specify information security requirements, and maintain operational systems security; and ensuring that field site personnel accurately assess their locations’ security postures. Information assurance managers at the various DLA locations directly report to the information technology chief at their location and are expected to assist the Director of Information Assurance by coordinating security activities, establishing and maintaining a repository for documenting and reporting system certification and accreditation activities, maintaining and updating system security authorization agreements, and notifying the designated approving authority of any changes that could affect system security. Information assurance officers at the various DLA locations assist the information assurance managers through the following activities: ensuring that appropriate information security controls are implemented for an information system, notifying the information assurance manager when system changes that might affect certification and accreditation are requested or planned, and conducting annual validation testing of systems. Figure 1 below shows a simplified overview of DLA’s information assurance management and reporting structure. Congress enacted FISMA to strengthen the security of information and information systems within federal agencies. FISMA requires each agency to develop, document, and implement an agencywide information security program to protect the information and information systems that support the operations and assets of the agency—including those that are provided or managed by another agency, a contractor, or some other source. The program must include the following: periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, modification, disruption, or destruction of information or information systems; training of personnel who have significant responsibility for information security and security awareness training to educate personnel— including contractors and other users of the agency’s information systems—about information security risks and their responsibilities to comply with the agency’s security policies and procedures; periodic testing and evaluation of the effectiveness of the agency’s information security policies, procedures, and practices; and a process for planning, implementing, evaluating, and documenting plans of action and milestones that are taken to address any deficiencies in the agency’s information security policies, procedures, and practices. To support agencies in conducting their information security programs, the National Institute of Standards and Technology (NIST) is publishing mandatory standards and guidelines for providing information security all agency operations, assets, and information systems other than national security systems. The standards and guidelines include, at a minimum, (1) standards to be used by all agencies to categorize their information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels, (2) guidelines recommending the types of information and information systems that are to be included in each category, and (3) minimum information security requirements for information and information systems in each category. In addition, DOD has developed and published various directives and instructions that comprise an information assurance policy framework that is intended to meet the information security requirements specified in FISMA and NIST standards and publications. This framework applies to all of DOD’s systems—both national and non-national security systems— including those operated by or on behalf of DLA. DLA’s policies and procedures for implementing its agency information security program are contained in DLA’s One Book policy and agency handbook. DLA has implemented important elements of an information security program—including establishing a central security management group, appointing a senior information security officer to manage the program, and providing security awareness training for its employees. However, DLA has not yet fully implemented other essential elements of an effective information security program to protect the confidentiality, integrity, and availability of its information and information systems that support its mission. Collectively, these weaknesses place DLA’s information and information systems at risk. Key underlying reasons for the weaknesses pertain to DLA’s management and oversight of its security program. In carrying out their information security responsibilities, both the Chief Information Officer and the Director of Information Assurance have taken several steps to implement important elements of DLA’s security program, including the following: ensuring employees and contractors receive information security developing information security procedures and guidance for use in implementing the requirements of the program; deploying information system security engineers to assist headquarters and field staff in implementing security policies and procedures consistently across the agency; developing an agencywide management tool—known as the Comprehensive Information Assurance Knowledgebase—to centrally manage and report on key performance measures, such as the status of security training, plans of action and milestones, and certification and accreditation activities; and developing and implementing various automated information technology initiatives to assist information assurance managers and information assurance officers in improving DLA’s security posture. Weaknesses in information security practices and controls place DLA’s information and information systems at risk. Our analysis of information security activities for selected systems at 10 DLA locations showed that the agency had not fully or consistently implemented important elements of its program. Specifically, risks that could result from the unauthorized access, use, disclosure, or destruction of information or information systems were not consistently assessed; employees who had significant information security responsibilities did not receive sufficient training, and security training plans were sometimes not adequately completed; testing and evaluation of the effectiveness of management and operational security controls were not adequately performed; and plans of action and milestones for mitigating known information security deficiencies were not sufficiently completed. Table 1 indicates with an “X” weaknesses in the implementation of key information security practices and controls for selected systems. FISMA requires that agencies’ information security programs include periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency. Identifying and assessing information security risks are essential steps in order to determine what controls are required and what level of resources should be expended on these controls. NIST has developed guidance to help organizations protect their information and information systems by using security controls that are selected through a risk-based process. DOD established a set of baseline security controls for each of three mission assurance categories that determine what security controls should be implemented. These controls are adjusted based on an assessment of risk including specific threat information, vulnerabilities, and countermeasures relative to the system. Vulnerabilities that are not mitigated are referred to as residual risk. The designated approving authority considers the residual risks in determining whether to accredit a system. Such risk assessments, as part of the requirement to reaccredit systems, are to be performed prior to a significant change in processing, but at least every 3 years. Although DLA categorized its systems in accordance with DOD guidance, we found that it did not consistently assess the residual risk for 9 of the 10 systems we selected for review.