Performance measures can be used to facilitate decision making and improve performance and accountability through the collection, analysis, and reporting of relevant data. The purpose of measuring performance is to monitor the status of measured activities and facilitate improvement in those activities by applying corrective actions based on observed measurements. Such measures can be used to monitor the accomplishment of goals and objectives and analyze the adequacy of control activities. Thus, performance measures should provide managers and other stakeholders with timely, action-oriented information in a format that facilitates decisions aimed at improving program performance. Measuring performance allows organizations to track the progress they are making toward their goals and gives managers crucial information on which to base their organizational and management decisions. Performance measures can also create powerful incentives to influence organizational and individual behavior. Performance measures, including information security measures, are a key element in the performance management approach to implementing federal programs. The Government Performance and Results Act of 1993 (GPRA) established a statutory framework for performance management and accountability within the federal government. GPRA introduced planning and reporting requirements that sought to shift the focus of federal management and decision making from a preoccupation with the number of program tasks or activities completed or services provided to a more direct consideration of the results of programs. The act was intended to improve federal program effectiveness, accountability, and service delivery. It requires federal agencies to develop both long- and near-term outcome-oriented goals, to describe how they will measure progress toward the achievement of those goals in annual performance plans, and to report annually on their progress in program performance reports. GPRA incorporates performance measurement as one of its most important features. In reviewing performance measures shortly after GPRA was enacted, we found that agencies that were successful in adopting performance measures ensured that the measures (1) were tied to program goals and demonstrated the degree to which the desired results were achieved, (2) were limited to a vital few that were considered essential for producing data for decision making, (3) covered multiple priorities, and (4) provided useful information for decision making. However, despite having more performance measures available, federal managers’ reported use of performance information in management decision making has not changed significantly. We have previously reported practices that can facilitate using performance information for decision making. For example, to ensure that performance information will be both useful and used in decision making throughout the organization, agencies need to consider users’ differing policy and management information needs. Practices that improve the usefulness of performance information can help to meet those needs. Performance planning and measurement have slowly yet increasingly become a part of agencies’ cultures. According to three governmentwide, random sample surveys of federal managers that we conducted in 1997, 2000, and 2003, managers reported having significantly more of the types of performance measures called for by GPRA, particularly outcome- oriented performance measures, in 2003 than in 1997, when GPRA went into effect governmentwide. The Federal Information Security Management Act (FISMA), which was enacted in 2002 as part of the E-Government Act, sets forth a comprehensive framework for ensuring the effectiveness of security controls over information resources that support federal operations and assets. FISMA’s framework is based on a cycle of risk management activities necessary for an effective security program, such as assessing risk, establishing a central management focal point, implementing appropriate policies and procedures, promoting awareness, and monitoring and evaluating policy and control effectiveness. In order to ensure the implementation of this framework, the act assigns specific responsibilities to agencies, OMB, and NIST. FISMA requires agencies to implement information security programs that include such things as periodic assessments of risk; risk-based policies and procedures; security awareness training; and procedures for detecting, reporting, and responding to security incidents. Further, FISMA also requires each agency to report annually to OMB, selected congressional committees, and the Comptroller General of the United States on the adequacy of its information security policies, procedures, practices, and compliance with requirements. FISMA also requires agencies to have independent evaluations of their information security programs conducted on an annual basis by the agency Inspector General or an independent external auditor. These evaluations are to include testing of the effectiveness of the information security policies, procedures, and practices of a representative subset of the agency’s information systems as well as an assessment of compliance with the requirements of the act. FISMA states that the director of OMB shall oversee agency information security policies and practices including, among other things, overseeing agency compliance with FISMA to enforce accountability, and reviewing at least annually and approving or disapproving agency information security programs. In addition, the act requires that OMB report to Congress no later than March 1 of each year on agency compliance with FISMA. To meet its requirements, OMB requires federal agencies to annually report on information security, and sets forth its requirements for meeting these provisions in annual reporting instructions to agencies. The instructions require agencies to provide information with regard to, among other things, certification and accreditation, security awareness training, incident response, and configuration management. Beginning in 2007, OMB has also required agencies to provide information on measures related to the effectiveness of their security policies and procedures. In all, OMB has established a uniform set of 24 measures of information security programs that all federal agencies report on annually. OMB uses the information submitted by agencies as well as a summary of the findings of independent evaluations in its overall evaluation of federal information security performance. In its report to Congress, OMB is to identify significant deficiencies in agency information security practices as well as planned remedial actions to address such deficiencies. OMB’s 2008 report to Congress provided information on the federal government’s progress in meeting key security performance measures from fiscal year 2002 through 2008, an assessment of governmentwide information technology (IT) security strengths and weaknesses, and a plan of action to improve performance. Additionally, agency Inspectors General were asked to provide information on the quality of agency plans of action, milestone processes, and certification and accreditation processes, as well as assessments of the completeness of agency systems inventories. Under FISMA, NIST is tasked with developing standards to be used by agencies to categorize their information and systems, based on the objectives of providing appropriate levels of information security according to a range of risk levels, as well as minimum information security requirements for information and systems in each category. In July 2008, NIST published its Performance Measurement Guide for Information Security to assist agencies in the development, selection, and implementation of information system-level and program-level measures. The guide describes how an organization, through the use of measures, can identify the adequacy of in-place security controls, policies, and procedures. The guide also provides an underlying data collection, analysis, and reporting infrastructure that can be tailored to support FISMA performance measures. OMB requires agencies to follow NIST guidance in implementing their information security programs, and thus agencies are required to follow the practices in the NIST performance measurement guide. We have previously reported that despite federal agencies’ reported progress and increased security-related activities, weaknesses remained in the processes they used for implementing FISMA. In addition, we have also identified a need to improve the use of performance measures to assist agencies in FISMA implementation and have made recommendations to OMB on its annual reporting instructions to agencies: In 2005, 2006, and 2007, we recommended that OMB improve FISMA reporting by clarifying reporting instructions and requesting agency Inspectors General to report on the quality of additional agency processes, such as the annual system reviews, system test and evaluation, risk categorization, security awareness training, and incident reporting. Additionally, in 2007 we recommended that OMB develop additional performance measures that gauge the effectiveness of FISMA activities. OMB agreed to take our recommendations under advisement when modifying its FISMA reporting instructions for subsequent years. Leading organizations and experts have identified different types of measures that are useful in helping to achieve information security goals. While officials categorized these types using varying terminology, we concluded that they generally fell into three categories: (1) compliance, (2) effectiveness of controls, and (3) program impact. These three categories are consistent with those laid out by NIST in its information security performance measurement guide, which serves as official guidance on information security measures for federal agencies and which OMB requires agencies to follow. Leading organizations developed compliance measures to determine the extent to which security controls were in place that adhered to internal policies, industry standards, or other legal or regulatory requirements. NIST guidance refers to these as implementation measures because they focus on measuring progress in implementing security programs, specific security controls, and associated policies and procedures. These measures are effective at pointing out where improvements are needed in implementing required policies and procedures. However, they provide only limited insight into the overall performance of an organization’s information security program. As an example, a state organization reported that it was subject to a variety of specific requirements concerning the structure of its information security program. To demonstrate compliance with these requirements, the organization reported that it used measures such as whether quarterly updates were made to corrective action plans and whether an information security officer had been designated within a specified number of years. Another organization reported that it was subject to an industry regulation requiring managers to complete reviews of applications for employee access rights. To measure compliance with this regulation, the organization established a metric that identified the percentage of managers who had completed such reviews. Control effectiveness measures go beyond compliance measures to characterize the extent to which specific control activities within an organization’s information security program meet their objectives. Rather than merely capturing what controls are in place, such measures gauge how effectively the controls have been implemented. These types of measures can show such things as how well an organization responds to security events or the likelihood that known vulnerabilities will be exploited. According to NIST, such measures concentrate on the evidence and results of assessments and may require multiple data points quantifying the degree to which information security controls are implemented and the resulting effect on an organization’s information security posture.