This is the accessible text file for GAO report number GAO-05-567T 
entitled 'Information Security: Department of Homeland Security Faces 
Challenges in Fulfilling Statutory Requirements' which was released on 
April 14, 2005.

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

United States Government Accountability Office: 

GAO: 

Testimony: 

Before the House Subcommittee on Management, Integration, and 
Oversight, Committee on Homeland Security: 

For Release on Delivery: 

2:00 p.m. EDT Thursday, April 14, 2005: 

Information Security: 

Department of Homeland Security Faces Challenges in Fulfilling 
Statutory Requirements: 

Statement of Gregory C. Wilshusen, Director, Information Security 
Issues: 

GAO-05-567T: 

GAO Highlights: 

Highlights of GAO-05-567T, a testimony before the House Subcommittee on 
Management, Integration, and Oversight, Committee on Homeland Security: 

Why GAO Did This Study: 

For many years, GAO has reported that poor information security is a 
widespread problem that has potentially devastating consequences. 
Accordingly, since 1997, GAO has identified information security as a 
governmentwide high-risk issue in reports to Congress—most recently in 
January 2005.

Concerned with accounts of attacks on commercial systems via the 
Internet and reports of significant weaknesses in federal computer 
systems that made them vulnerable to attack, Congress passed the 
Federal Information Security Management Act of 2002 (FISMA), which 
permanently authorized and strengthened the federal information 
security program, evaluation, and reporting requirements established 
for federal agencies. FISMA requires that agencies report annually to 
OMB who issues guidance for that reporting process.

The Department of Homeland Security (DHS), the third largest agency in 
the federal government, uses a variety of major applications and 
general systems in support of operational and administrative 
requirements. 

This testimony discusses DHS’s progress and challenges in implementing 
FISMA as reported by the agency and its Inspector General (IG).

What GAO Found: 

DHS has made progress in implementing key federal information security 
requirements, yet it continues to face challenges in fulfilling the 
requirements mandated by FISMA. In its fiscal year 2004 report on FISMA 
implementation, DHS highlights increases in the majority of the key 
performance measures (developed by the Office of Management and Budget 
(OMB) to track agency performance in implementing information security 
requirements), such as the percentage of agency systems reviewed and 
percentage of employee and contractor personnel who received security 
awareness training (see figure). For example, DHS reported a 
substantial increase in the percentage of personnel that received 
security awareness training, rising from 14 percent in fiscal year 2003 
to 85 percent in fiscal year 2004. However, DHS continues to face 
significant challenges in meeting most statutory information security 
requirements. For example, DHS has yet to develop a complete and 
accurate inventory or an effective remediation process.

Figure: DHS Performance Data for Key OMB Performance Measures: 

[See PDF for image]

[End of figure]

www.gao.gov/cgi-bin/getrpt?GAO-05-567T.

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact Gregory C. Wilshusen at 
(202) 512-3317 or wilshuseng@gao.gov.

[End of section]

Abbreviations: 

CIO: chief information officer: 

DHS: Department of Homeland Security: 

DOD: Department of Defense: 

FISMA: Federal Information Security Management Act of 2002: 

IG: inspector general: 

IT: information technology: 

OMB: Office of Management and Budget: 

NIST: National Institute of Standards and Technology: 

Mr. Chairman and Members of the Subcommittee: 

I am pleased to be here today to discuss efforts by the Department of 
Homeland Security (DHS) to implement requirements of the Federal 
Information Security Management Act of 2002 (FISMA).[Footnote 1] For 
many years, we have reported that poor information security is a 
widespread problem that has potentially devastating 
consequences.[Footnote 2] Accordingly, since 1997, we have identified 
information security as a governmentwide high-risk issue in reports to 
Congress--most recently in January 2005.[Footnote 3] Concerned with 
accounts of attacks on commercial systems via the Internet and reports 
of significant weaknesses in federal computer systems that made them 
vulnerable to attack, Congress passed FISMA, which permanently 
authorized and strengthened the federal information security program, 
evaluation, and reporting requirements established for federal 
agencies. Under FISMA, agencies are to report annually to the Office of 
Management and Budget (OMB) who issues guidance for that reporting. 

In my testimony today, I will summarize the reported status of DHS's 
implementation of FISMA, including areas of progress and continuing 
challenges. 

In conducting this review, we analyzed and summarized DHS's fiscal year 
2003 and 2004 reports to Congress on FISMA implementation. We also 
reviewed and summarized the fiscal year 2004 FISMA reports for 24 of 
the largest federal agencies and their Inspectors General (IGs). In 
addition, we reviewed standards and guidance issued by Office of 
Management and Budget (OMB) and the National Institute of Standards and 
Technology (NIST) pursuant to their FISMA responsibilities. Finally, we 
reviewed OMB's 2004 report to Congress on the implementation of FISMA 
governmentwide.[Footnote 4] We did not validate the accuracy of the 
data reported by DHS, the other 23 CFO agencies, or OMB, but did 
analyze the IGs' fiscal year 2004 FISMA reports to identify any issues 
related to the accuracy of agency-reported information. We performed 
our work from October 2004 to March 2005 in accordance with generally 
accepted government auditing standards. In addition, we continue to 
perform on-going work on DHS's management of information security. 

Results in Brief: 

DHS has made progress in implementing key federal information security 
requirements, yet it continues to face challenges in fulfilling the 
requirements mandated by FISMA. In its fiscal year 2004 report on FISMA 
implementation, DHS highlights increases in the majority of the key 
performance measures (developed by OMB to track agency performance in 
implementing information security requirements), such as the percentage 
of agency systems reviewed and percentage of employee and contractor 
personnel who received security awareness training. For example, DHS 
reported a substantial increase in the percentage of personnel that 
received security awareness training, rising from 14 percent in fiscal 
year 2003 to 85 percent in fiscal year 2004. However, DHS continues to 
face significant challenges in meeting most statutory information 
security requirements. For example, DHS has yet to develop a complete 
and accurate inventory or an effective remediation process. 

Background: 

Since the early 1990s, increasing computer interconnectivity--most 
notably growth in the use of the Internet--has revolutionized the way 
that our government, our nation, and much of the world communicate and 
conduct business. While the benefits have been enormous, without proper 
safeguards, this widespread interconnectivity also poses significant 
risks to the government's computer systems and, more importantly, to 
the critical operations and infrastructures they support. 

We recently reported that, while federal agencies showed improvement in 
addressing information security, they also continued to have 
significant control weaknesses in federal computer systems that put 
federal operations and assets at risk of inadvertent or deliberate 
misuse, financial information at risk of unauthorized modification or 
destruction, sensitive information at risk of inappropriate disclosure, 
and critical operations at the risk of disruption. The significance of 
these weaknesses led us to conclude in the audit of the federal 
government's fiscal year 2004 financial statements[Footnote 5] that 
information security was a material weakness.[Footnote 6] Our audits 
also identified instances of similar types of weaknesses in non- 
financial systems. Weaknesses continued to be reported in each of the 
six major areas of general controls--the policies, procedures, and 
technical controls that apply to all or a large segment of an entity's 
information systems and help ensure their proper operation. 

To fully understand the significance of the weaknesses we identified, 
it is necessary to link them to the risks they present to federal 
operations and assets. Virtually all federal operations are supported 
by automated systems and electronic data, and agencies would find it 
difficult, if not impossible, to carry out their missions and account 
for their resources without these information assets. Hence, the degree 
of risk caused by security weaknesses is high. The weaknesses 
identified place a broad array of federal operations and assets at 
risk. For example: 

* resources, such as federal payments and collections, could be lost or 
stolen;

* computer resources could be used for unauthorized purposes or to 
launch attacks on others;

* sensitive information, such as taxpayer data, social security 
records, medical records, and proprietary business information could be 
inappropriately disclosed, browsed, or copied for purposes of 
industrial espionage or other types of crime;

* critical operations, such as those supporting national defense and 
emergency services, could be disrupted;

* data could be modified or destroyed for purposes of fraud, identity 
theft, or disruption; and: 

* agency missions could be undermined by embarrassing incidents that 
result in diminished confidence in their ability to conduct operations 
and fulfill their fiduciary responsibilities. 

Congress and the administration have established specific information 
security requirements in both law and policy to help protect the 
information and information systems that support these critical 
operations and assets. 

FISMA Authorized and Strengthened Information Security Requirements: 

Enacted into law on December 17, 2002, as Title III of the E-Government 
Act of 2002, FISMA authorized and strengthened information security 
program, evaluation, and reporting requirements. FISMA assigns specific 
responsibilities to agency heads, chief information officers, and IGs. 
It also assigns responsibilities to OMB, which include developing and 
overseeing the implementation of policies, principles, standards, and 
guidelines on information security and reviewing at least annually, and 
approving or disapproving, agency information security programs. 

Overall, FISMA requires each agency to develop, document, and implement 
an agencywide information security program. This program should provide 
information security for the information and information systems that 
support the operations and assets of the agency, including those 
provided or managed by another agency, contractor, or other source. 
Specifically, this program is to include: 

* periodic assessments of the risk and magnitude of harm that could 
result from the unauthorized access, use, disclosure, disruption, 
modification, or destruction of information or information systems;

* risk-based policies and procedures that cost-effectively reduce 
information security risks to an acceptable level and ensure that 
information security is addressed throughout the life cycle of each 
information system;

* subordinate plans for providing adequate information security for 
networks, facilities, and systems or groups of information systems;

* security awareness training for agency personnel, including 
contractors and other users of information systems that support the 
operations and assets of the agency;

* periodic testing and evaluation of the effectiveness of information 
security policies, procedures, and practices, performed with a 
frequency depending on risk, but no less than annually, and that 
includes testing of management, operational, and technical controls for 
every system identified in the agency's required inventory of major 
information systems;

* a process for planning, implementing, evaluating, and documenting 
remedial action to address any deficiencies in the information security 
policies, procedures, and practices of the agency;

* procedures for detecting, reporting, and responding to security 
incidents; and: 

* plans and procedures to ensure continuity of operations for 
information systems that support the operations and assets of the 
agency. 

FISMA also established a requirement that each agency develop, 
maintain, and annually update an inventory of major information systems 
operated by the agency or that are under its control. This inventory is 
to include an identification of the interfaces between each system and 
all other systems or networks, including those not operated by or under 
the control of the agency. 

Each agency is also required to have an annual independent evaluation 
of its information security program and practices, including control 
testing and compliance assessment. Evaluations of non-national security 
systems are to be performed by the agency IG or by an independent 
external auditor, while evaluations related to national security 
systems are to be performed only by an entity designated by the agency 
head. 

The agencies are to report annually to OMB, selected congressional 
committees, and the Comptroller General on the adequacy of information 
security policies, procedures, practices, and compliance with FISMA 
requirements. In addition, agency heads are required to make annual 
reports of the results of their independent evaluations to OMB. OMB is 
also required to submit a report to Congress no later than March 1 of 
each year on agency compliance, including a summary of the findings of 
agencies' independent evaluations. 

Other major provisions require NIST to develop, for systems other than 
national security systems: (1) standards to be used by all agencies to 
categorize all their information and information systems based on the 
objectives of providing appropriate levels of information security 
according to a range of risk levels; (2) guidelines recommending the 
types of information and information systems to be included in each 
category; and (3) minimum information security requirements for 
information and information systems in each category. NIST must also 
develop a definition and guidelines concerning detection and handling 
of information security incidents and guidelines, developed in 
conjunction with the Department of Defense (DOD) and the National 
Security Agency, for identifying an information system as a national 
security system. 

OMB Reporting Instructions and Guidance Emphasize Performance Measures: 

Consistent with FISMA requirements, OMB issues guidance to the agencies 
on their annual reporting requirements. On August 23, 2004, OMB issued 
its fiscal year 2004 reporting instructions. The reporting 
instructions, similar to the 2003 instructions, emphasized a strong 
focus on performance measures and formatted these instructions to 
emphasize a quantitative response. OMB has developed performance 
measures in the following areas, including: 

* certification and accreditation,[Footnote 7]

* annual review of agency systems,

* annual review of contractor operations or facilities,

* annual security awareness training for employees and contractors,

* annual specialized training for employees with significant security 
responsibilities, and: 

* testing of contingency plans. 

Further, OMB provided instructions for continued agency reporting on 
the status of remediation efforts through plans of action and 
milestones. Required for all programs and systems where an IT security 
weakness has been found, these plans list the weaknesses and show 
estimated resource needs or other challenges to resolving them, key 
milestones and completion dates, and the status of corrective actions. 
The plans are to be submitted twice a year. In addition, agencies are 
to submit quarterly updates that indicate the number of weaknesses for 
which corrective action was completed on time (including testing), is 
ongoing and on track to be completed as originally scheduled, or has 
been delayed, as well as the number of new weaknesses discovered since 
the last update. 

The IGs' reports were to be based on the results of their independent 
evaluations, including work performed throughout the reporting period 
(such as financial statements or other audits). While OMB asked the IGs 
to respond to the same questions as the agencies, it also asked them to 
assess whether their agency had developed, implemented, and was 
managing an agencywide plan of actions and milestones. Further, OMB 
asked the IGs to assess the certification and accreditation process at 
their agencies. OMB did not request that the IGs validate agency 
responses to the performance measures. Instead, as part of their 
independent evaluations of a subset of agency systems, IGs were asked 
to assess the reliability of the data for those systems that they 
evaluated. 

Recently-created Department of Homeland Security is Large and Complex: 

In the aftermath of September 11, invigorating the nation's homeland 
security missions became one of the federal government's most 
significant challenges. The Homeland Security Act of 2002 created DHS, 
combining 22 agencies into one department. DHS, with an estimated 
170,000 employees, is the third largest government agency. Not since 
the creation of DOD more than 50 years ago had the government sought an 
integration and transformation of this magnitude. 

GAO designated implementing and transforming DHS as high risk in 2003 
because DHS had to transform 22 agencies--several with major management 
challenges--into one department, and failure to effectively address its 
management challenges and program risks could have serious consequences 
for our national security.[Footnote 8] DHS combined 22 agencies 
specializing in various disciplines: law enforcement, border security, 
biological research, disaster mitigation, and computer security, for 
instance. Further, DHS oversees a number of non-homeland-security 
activities, such as the Coast Guard's marine safety responsibilities 
and the Federal Emergency Management Agency's natural disaster response 
functions. 

DHS has lead responsibility for preventing terrorist attacks in the 
United States, reducing the vulnerability of the United States to 
terrorist attacks, and minimizing the damage and assisting in the 
recovery from attacks that do occur. DHS has five under secretaries 
with responsibility over directorates for management, science and 
technology, information analysis and infrastructure protection, border 
and transportation security, and emergency preparedness and response. 
In addition, the department has four other organizations that report 
directly to the Secretary. 

DHS uses a variety of major applications and general support systems in 
support of operational and administrative requirements. In its 2004 
FISMA report, DHS stated that it had 395 systems and 61 contractor 
operations. These systems often served specific organizations that are 
now merged with others, resulting in interoperability issues, data 
management concerns, and incompatible environments or duplicative 
processes. 

Department of Homeland Security's FISMA Reports Highlight Increases in 
Performance Measures, but Challenges Remain: 

In its FISMA-mandated report for fiscal year 2004, DHS generally 
reported increases in compliance with information security requirements 
as compared with 2003. However, DHS continues to face significant 
challenges. The following key performance measures showed increased 
performance and/or continuing challenges: 

* percentage of systems certified and accredited;

* percentage of agency systems reviewed annually;

* percentage of contractor operations reviewed annually;

* percentage of employees and contractors receiving annual security 
awareness training;

* percentage of employees with significant security responsibilities 
receiving specialized security training annually; and: 

* percentage of systems with contingency plans tested. 

Figure 1 illustrates the reported overall status of DHS in meeting 
these performance measures and the changes between fiscal years 2003 
and 2004. 

Figure 1: DHS Reported Data for Key Performance Measures: 

[See PDF for image]

[End of figure]

DHS has yet to develop a complete and accurate inventory, or an 
effective plan of action and milestones.[Footnote 9] Finally, figure 2 
illustrates how DHS compares to the governmentwide results for the 
performance measures when compared to the aggregated data of all 24 CFO 
agencies. 

Figure 2: Comparison of DHS Data to Governmentwide Performance: 

[See PDF for image]

[End of figure]

Certification and Accreditation: 

Included in OMB's policy for federal information security is a 
requirement that agency management officials formally authorize their 
information systems to process information and, thereby, accept the 
risk associated with their operation. This management authorization 
(accreditation) is to be supported by a formal technical evaluation 
(certification) of the management, operational, and technical controls 
established in an information system's security plan. In 2003, agencies 
were required to report separately on risk assessments and security 
plans. In 2004, OMB eliminated this separate reporting in its guidance 
and directed agencies to complete risk assessments and security plans 
for the certification and accreditation process to be accomplished. As 
a result, the performance measure for certification and accreditation 
now also reflects the level of agency compliance for risk assessments 
and security plans. For FISMA reporting, OMB requires agencies to 
report the number of systems authorized for processing after completing 
certification and accreditation. 

DHS reported a significant increase for this performance measure in its 
fiscal year 2004 report. The Department reported that approximately 68 
percent of its systems had been certified and accredited, an increase 
of 26 percent over fiscal year 2003. Governmentwide, 77 percent of all 
systems were certified and accredited compared to the 68 percent at 
DHS. If agencies do not certify and accredit their systems, they cannot 
be assured that risks have been identified and mitigated to an 
acceptable level. 

Moreover, the DHS IG reported in its 2004 FISMA report that the 
certification and accreditation process at the Department was poor. The 
report noted that the certification and accreditation process was not 
performed consistently across the Department. In addition, there were 
instances where certified and accredited systems lacked key security 
documentation such as up-to-date and approved security plans, a current 
risk assessment, and contingency plans. As a result, the agency 
reported performance data may not accurately reflect the status of 
DHS's efforts to implement this requirement. 

Annual Review of Agency Systems: 

FISMA requires that agency information security programs include 
periodic testing and evaluation of the effectiveness of information 
security policies, procedures, and practices to be performed with a 
frequency that depends on risk, but no less than annually. This is to 
include testing of management, operational, and technical controls for 
every information system identified in the FISMA-required inventory of 
major systems. Periodically evaluating the effectiveness of security 
policies and controls and acting to address any identified weaknesses 
are fundamental activities that allow an organization to manage its 
information security risks cost effectively, rather than reacting to 
individual problems ad hoc only after a violation has been detected or 
an audit finding has been reported. Further, management control testing 
and evaluation as part of program reviews is an additional source of 
information that can be considered along with control testing and 
evaluation in IG and GAO audits to help provide a more complete picture 
of the agencies' security postures. As a performance measure for this 
requirement, OMB requires that agencies report the number of systems 
that they have reviewed during the year. 

DHS reported performing an annual review on an increased percentage of 
its systems. It reported in 2004 that it had reviewed 54 percent of its 
systems, as compared to 44 percent in 2003. In 2004, 23 of the 24 CFO 
agencies reported that they had reviewed 90 percent or more of their 
systems. Annual security testing helps to provide assurance to the 
agencies that security controls are in place and functioning correctly. 
Without such testing, agencies cannot be assured that their information 
and systems are protected. 

Annual Review of Contractor Operations: 

Under FISMA, agency heads are responsible for providing information 
security protections for information collected or maintained by or on 
behalf of the agency and information systems used or operated by an 
agency or by a contractor. Thus, agency information security programs 
apply to all organizations that possess or use federal information or 
that operate, use, or have access to federal information systems on 
behalf of a federal agency. Other such organizations may include 
contractors, grantees, state and local governments, and industry 
partners. This underscores longstanding OMB policy concerning sharing 
government information and interconnecting systems: federal security 
requirements continue to apply and the agency is responsible for 
ensuring appropriate security controls. 

At DHS, the key performance measure of annually reviewing contractor 
operations showed a minor decrease from 73 percent in 2003 to 67 
percent in 2004. Twenty of the Department's contractor operations were 
not reviewed. The governmentwide performance measure was reported as 83 
percent of all contractor operations reviewed. If agencies do not 
review contractor operations, they cannot be assured that federal data 
is being handled in accordance with agency requirements. 

Security Awareness Training: 

FISMA requires agencies to provide security awareness training to 
inform personnel, including contractors and other users of information 
systems that support the operations and assets of the agency, of 
information security risks associated with their activities, and the 
agency's responsibilities in complying with policies and procedures 
designed to reduce these risks. Our studies of best practices at 
leading organizations[Footnote 10] have shown that such organizations 
took steps to ensure that personnel involved in various aspects of 
their information security programs had the skills and knowledge they 
needed. Agencies reported that they provided security awareness 
training to the majority of their employees and contractors. As 
performance measures for FISMA training requirements, OMB has the 
agencies report the number of employees and contractors who received IT 
security training during fiscal year 2004. 

DHS reported a substantial increase in the percentage of employees and 
contractors who received security awareness training in fiscal year 
2004. The Department reported that it had trained 85 percent of its 
staff compared to 14 percent in 2003. As a result, reported performance 
is comparable to the majority of agencies in this performance measure, 
as seventeen agencies reported that they had trained more than 90 
percent of their employees and contractors in basic security awareness. 

Specialized Security Training: 

Under FISMA, agencies are required to provide training in information 
security to personnel with significant security responsibilities. As 
previously noted, our study of best practices at leading organizations 
has shown that such organizations recognized that staff expertise 
needed to be updated frequently to keep security employees updated on 
changes in threats, vulnerabilities, software, security techniques, and 
security monitoring tools. OMB directs agencies to report on the 
percentage of their employees with significant security 
responsibilities who received specialized training. 

DHS presented substantial improvement in this performance measure, 
reporting that it had provided specialized training to more than 90 
percent of its employees who have significant security 
responsibilities. Not only was this a significant improvement over the 
66 percent reported in 2003, it also places DHS among the top ten 
agencies governmentwide for this performance measure. Given the rapidly 
changing threats in information security, agencies need to keep their 
IT security employees up-to-date on changes in technology. Otherwise, 
agencies may face increased risk of security breaches. 

Testing of Contingency Plans: 

Contingency plans provide specific instructions for restoring critical 
systems, including such elements as arrangements for alternative 
processing facilities in case the usual facilities are significantly 
damaged or cannot be accessed due to unexpected events such as 
temporary power failure, accidental loss of files, or a major disaster. 
It is important that these plans be clearly documented, communicated to 
potentially affected staff, and updated to reflect current operations. 

The testing of contingency plans is essential to determining whether 
plans will function as intended in an emergency situation. The 
frequency of plan testing will vary depending on the criticality of the 
entity's operations. The most useful tests involve simulating a 
disaster situation to test overall service continuity. Such a test 
would include testing whether the alternative data processing site will 
function as intended and whether critical computer data and programs 
recovered from off-site storage are accessible and current. In 
executing the plan, managers will be able to identify weaknesses and 
make changes accordingly. Moreover, tests will assess how well 
employees have been trained to carry out their roles and 
responsibilities in a disaster situation. To show the status of 
implementing this requirement, OMB requires that agencies report the 
number of systems that have a contingency plan and the number that have 
contingency plans that have been tested. 

DHS reported a modest increase in the percentage of contingency plans 
tested. The department stated that it had tested contingency plans for 
21 percent of its systems, an 8 percentage point increase over 2003. 
Moreover, analysis of the numbers reveals that DHS tested 82 plans, 
which was almost double what it tested in 2003. However, the majority 
of its systems do not have tested contingency plans. Overall, federal 
agencies reported that 57 percent of systems had contingency plans that 
had been tested. Without testing, agencies can have limited assurance 
that they will be able to recover mission-critical applications, 
business processes, and information in the event of an unexpected 
interruption. 

Other Challenges in Implementing Statutory Requirements: 

In addition to the performance measures, there are other requirements 
that agencies must meet under FISMA. Agencies are required to have a 
complete and accurate inventory of their major systems and any 
interdependencies. They are also required to have a remediation process 
for correcting identified information security weaknesses. 

The total number of agency systems is a key element in OMB's 
performance measures, in that agency progress is indicated by the 
percentage of total systems that meet specific information security 
requirements. Thus, inaccurate or incomplete data on the total number 
of agency systems affects the percentage of systems shown as meeting 
the requirements. Further, a complete inventory of major information 
systems is a key element of managing the agency's IT resources, 
including the security of those resources. 

DHS reported that it did not have a complete and accurate inventory in 
either 2003 or 2004. Without reliable information on DHS's inventories, 
the Department, the administration, and Congress cannot be fully 
assured of DHS's progress in implementing FISMA. 

FISMA requires each agency to develop a process for planning, 
implementing, evaluating, and documenting remedial actions to address 
any deficiencies in the information security policies, procedures and 
practices of the agency. OMB's implementing guidance refers to this 
process as a security plan of action and milestones. The chief 
information officer (CIO) is to manage the process for the agencies and 
program officials are required to regularly update the CIO on their 
progress in implementing remedial actions. This process allows both the 
CIO and the IG to monitor agency-wide progress, identify problems, and 
provide accurate reporting. In its annual reporting guidance, OMB asks 
the agency IGs to report on the status of the plan of action and 
milestones at their agencies. IGs were asked to evaluate the process 
based on the following criteria: 

* known IT security weaknesses from all components are incorporated;

* program officials develop, implement and manage plans for the systems 
they own and operate that have an IT security weakness;

* program officials report to the CIO on a regular basis (at least 
quarterly) on their remediation progress;

* CIO develops, implements and manages plans for the systems they own 
and operate that have an IT security weakness;

* CIO centrally tracks, maintains, and reviews all plan activities on 
at least a quarterly basis;

* The plan is the authoritative agency tool for agency and IG 
management to identify and monitor agency actions for corrected 
information security weaknesses;

* System-level plans are tied directly to the system budget request 
through the IT business case as required in OMB budget guidance;

* IG has access to the plans as requested;

* IG findings are incorporated into the process; and: 

* the process prioritizes IT security weaknesses to help ensure that 
significant weaknesses are addressed in a timely manner and receive 
appropriate resources. 

In its 2004 FISMA report, the DHS IG described problems with the plan 
of action and milestones process at DHS. According to the IG, seven of 
the nine major department components reviewed lacked a documented and 
implemented plan of action and milestones. Further, the IG stated that 
the CIO did not receive reports of remediation progress and did not 
ensure that components updated the status of their progress. Linkage of 
the plans to budget requests was reported as minimal at the component 
level. Seven of the nine components reviewed did not have a formal 
process to prioritize their IT security weaknesses. Finally, the IG 
reported that its findings were not incorporated into the plan of 
action and milestones at DHS. Without an effective, implemented 
remediation process, DHS cannot be assured that identified security 
weaknesses are tracked and corrected. 

In summary, DHS generally showed increases in the OMB performance 
measures for FISMA implementation in fiscal year 2004. However, it 
still faces challenges in implementing the statutory requirements. It 
faces significant challenges in both inventory development and the 
implementation of its remediation process. Accordingly, if information 
security is to continue to improve, agency management must remain 
committed to these efforts. The annual reports and performance measures 
will continue to be key tools for holding DHS accountable and providing 
a barometer of the overall status of its information security. 

Mr. Chairman, this concludes my statement. I would be happy to answer 
any questions from you or members of the Committee. 

Should you have any questions about this testimony, please contact me 
at (202) 512-3317 or Suzanne Lightman, Assistant Director, at (202) 512-
8146 or by e-mail at wilshuseng@gao.gov and lightmans@gao.gov, 
respectively. 

Other individuals making key contributions to this testimony include 
Larry Crosland, Season Dietrich, Nancy Glover, Carol Langelier, and 
Stephanie Lee. 

FOOTNOTES

[1] Federal Information Security Management Act of 2002, Title III, E- 
Government Act of 2002, Pub. L. No. 107-347, December 17, 2002. 

[2] GAO, Information Security: Opportunities for Improved OMB Oversight 
of Agency Practices, GAO/AIMD-96-110 (Washington, D.C.: Sept. 24, 
1996). 

[3] GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.: 
January, 2005). 

[4] Office of Management and Budget, Federal Information Security 
Management Act (FISMA) 2004 Report to Congress (Washington, D.C.: March 
1, 2005). 

[5] U.S. Department of the Treasury, 2004 Financial Report of the 
United States Government (Washington, D.C.; 2005). 

[6] A material weakness is a condition that precludes the entity's 
internal control from providing reasonable assurance that 
misstatements, losses, or noncompliance material in relation to the 
financial statements or to stewardship information would be prevented 
or detected on a timely basis. 

[7] Certification is a comprehensive process of assessing the level of 
security risk, identifying security controls needed to reduce risk and 
maintain it at an acceptable level, documenting security controls in a 
security plan, and testing controls to ensure they operate as intended. 
Accreditation is a written decision by an agency management official 
authorizing operation of a particular information system or group of 
systems. 

[8] GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.: 
January, 2005). 

[9] OMB's implementing guidance refers to the process of planning, 
implementing, evaluating, and documenting remedial actions to address 
any deficiencies in information security as a security plan of action 
and milestones. 

[10] GAO, Executive Guide: Information Security Management: Learning 
From Leading Organizations, GAO/AIMD-98-68 (May, 1998).