This is the accessible text file for GAO report number GAO-05-362 entitled 'Information Security: Improving Oversight of Access to Federal Systems and Data by Contractors Can Reduce Risk' which was released on May 23, 2005. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to Congressional Requesters: April 2005: Information Security: Improving Oversight of Access to Federal Systems and Data by Contractors Can Reduce Risk: [Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-05-362]: GAO Highlights: Highlights of GAO-05-362, a report to congressional requesters: Why GAO Did This Study: The federal government relies extensively on information technology services and systems provided by contractors. The Federal Information Security Management Act of 2002 (FISMA) requires agencies to establish information security programs that extend to contractors and other users of federal data and systems, such as grantees, state and local governments, and research and educational institutions. GAO was asked to (1) describe the information security risks associated with contractors and users with privileged access to federal data and systems; (2) identify methods federal agencies use to ensure security of information and systems provided or used by contractors and other users with privileged access to federal data; and (3) determine what steps the administration is taking to ensure implementation and oversight of security of federal information and systems provided or used by contractors and other users with privileged access. What GAO Found: Contractors and users with privileged access to federal data and systems provide valuable services that contribute to the efficient functioning of the government, but they present a range of related risks that must be managed effectively. Most agencies recognize risks to the confidentiality, integrity, and availability of their information and systems associated with the use of contractors and other users with privileged access to federal data and systems. In addition, agencies reported specific risks when contractors develop software or perform work at off-site facilities. Agencies use contracts, policies, and self-assessments as methods to ensure information security oversight of contractors; however, each method has limitations and needs further strengthening. For example, most agencies have not incorporated FISMA requirements, such as annual testing of controls, into their contract language. Additionally, most of the 24 major agencies reported having policies for contractors and users with privileged access to federal data and systems; however, GAO’s analysis of submitted agency policies found that only 5 agencies had established specific information security oversight policies (see figure). Finally, while the majority of agencies reported using a National Institute of Standards and Technology self-assessment tool to review contractor security capabilities, only 10 agencies reported using the tool to assess users with privileged access to federal data and systems, which may expose federal data to increased risk. The administration continues in its efforts to improve information security oversight of contractors, but challenges remain. For example, efforts to update the Federal Acquisition Regulation to address information security have been under way since 2002, but are not complete. OMB continues to gather data about the number of agency systems, including those that are operated by contractors and how many have been reviewed. However, the submitted data showed that several agencies disagreed internally on the number of contractor or agency systems. Finally, federal agencies could benefit from unified guidance for overseeing information security of contractors and privileged users of federal data and systems. Major Agencies with Security Policies for Contractors, Privileged Users of Federal Data and Systems, and Contractor Security Oversight: [See PDF for image] [End of figure] What GAO Recommends: GAO recommends that the Office of Management and Budget (OMB) ensure that the Federal Acquisition Regulation aligns with FISMA and that agencies develop contractor oversight policies We also recommend that the Commerce develop unified guidance. OMB and Commerce generally agreed with the results of this report. www.gao.gov/cgi-bin/getrpt?GAO-05-362. To view the full product, including the scope and methodology, click on the link above. For more information, contact Gregory C. Wilshusen (202) 512-3317 or wilshuseng@gao.gov. [End of section] Contents: Letter: Results in Brief: Background: Federal Agencies Face a Range of Risks from Contractors and Other Users of Federal Data and Systems: Agencies Use Various Methods for Overseeing Contractor Security: Administration Efforts to Improve Information Security of Contractors Continue, but Challenges Remain: Conclusions: Recommendations for Executive Action: Agency Comments on Our Evaluation: Appendixes: Appendix I: Objectives, Scope, and Methodology: Appendix II: Comments from the Department of Commerce: Appendix III: GAO Contact and Staff Acknowledgments: GAO Contact: Staff Acknowledgments: Tables: Table 1: Examples of Agency-Identified Risks to Federal Systems and Data Resulting from Reliance on Contractors: Table 2: The FAR Privacy or Security Safeguards Contract Language: Table 3: Number of Contractor Facilities and Operations Reported in Fiscal Year 2004: Figures: Figure 1: Federal Sources for Addressing Information Security Oversight of Contractor-Delivered IT Systems and Services: Figure 2: Major Agencies with Security Policies for Contractors, Privileged Users of Federal Data and Systems, and Contractor Security Oversight: Figure 3: Total Contractor Facilities and Number of Facilities Reviewed for 23 Federal Agencies in Fiscal Years 2002-2004: Abbreviations: CFO: chief financial officer: DOD: Department of Defense: FAR: Federal Acquisition Regulation: FISMA: Federal Information Security Management Act of 2002: GSA: General Services Administration: IT: information technology: NIST: National Institute of Standards and Technology: OMB: Office of Management and Budget: Letter April 22, 2005: The Honorable Tom Davis: Chairman, Committee on Government Reform: House of Representatives: The Honorable Adam Putnam: House of Representatives: The federal government increasingly relies on information technology (IT) systems to provide essential services affecting the health, economy, and defense of the nation. To assist in providing these important services, the federal government relies extensively on contractors to provide IT services and systems. In addition to contractors that provide systems and services to the federal government, other organizations possess or use federal information or have access to federal information systems. These other organizations with privileged access to federal data and systems can include grantees, state and local governments, and research and educational institutions. The Office of Management and Budget (OMB) cited contractor security as a governmentwide challenge in a 2001 information security report to Congress. Recognizing the need for agencies to have effective information security programs, Congress passed the Federal Information Security Management Act of 2002 (FISMA), which provides the overall framework for ensuring the effectiveness of information security controls that support federal operations and assets. FISMA requirements apply to all federal contractors and organizations or sources that possess or use federal information or that operate, use, or have access to federal information systems on behalf of an agency. Our objectives were to (1) describe the information security risks associated with the federal government's reliance on contractor- provided IT systems and services and other users with privileged access to federal data and systems; (2) identify methods used by federal agencies to ensure security of information and information systems that are operated, used, or accessed by contractors and other users with privileged access to federal data; and (3) discuss steps the administration is taking to ensure implementation and oversight of security of information and information systems that are operated, used, or accessed by contractors and other users with privileged access to federal data and systems. To accomplish our review, we surveyed the 24 Chief Financial Officers Act (CFO) agencies[Footnote 1] regarding their policies and procedures for overseeing contractor security. We analyzed documentation submitted by the federal agencies and interviewed relevant officials in OMB, the General Services Administration (GSA), the Federal Acquisition Regulation Council, the National Institute of Standards and Technology (NIST), and private sector officials in the banking and finance industries. We conducted our work between August 2004 and March 2005 in accordance with generally accepted government auditing standards. Details of our objectives, scope, and methodology are included in appendix I. Results in Brief: Contractors and users with privileged access to federal data and systems provide valuable services that contribute to the efficient functioning of the government, but a range of risks (including operational, strategic, and legal) must be managed effectively. Most agencies recognize risks to the confidentiality, integrity, and availability of their information and systems associated with the use of contractors and other users with privileged access to federal data and systems. For example, malicious code can be inserted into agency software and systems. In addition, agencies also reported specific risks when contractors develop software or perform work at off-site facilities. Federal agencies reported additional risks to their operations posed by other users with privileged access to federal data and systems, such as lack of controlled network connections, poor access controls, and the introduction of viruses and worms.[Footnote 2] Agencies use contracts, policies, and self-assessments for ensuring information security oversight of contractors; however, each of these methods has limitations and needs further strengthening. Most agencies reported using contract language to establish information security requirements for contractors. However, agency-provided contract language generally did not address key elements of FISMA, such as annual testing of controls. In addition, the majority of agencies reported having information security policies for contractors and almost two-thirds of the agencies reported having such policies for other users with privileged access to federal data. Yet our analysis of agency-provided policies found that only 5 agencies had established policies that specifically addressed information security oversight of contractor-provided systems. Finally, the majority of agencies reported using the NIST self-assessment tool to assess contractor security capabilities. However, only 10 reported using the tool to assess the security implemented by other users with privileged access to federal data. The administration continues in its efforts to improve information security oversight of contractors, but challenges remain. For example, efforts to update the Federal Acquisition Regulation (FAR) to include the information security requirements of FISMA (which would be reflected in all relevant government contracts) have been under way since 2002, but are not yet complete. OMB continues to gather data about the number of agency systems, including those that are operated by contractors, and how many have been reviewed using a self-assessment tool. However, the data submitted showed that several agencies' chief information officers and inspectors general disagreed on the number of contractor or agency systems by as many as 100 systems or more. In addition, the data collected by OMB does not address other users with privileged access to federal data or the quality of the self assessments. Finally, NIST has developed guidance, parts of which are relevant to contractor security oversight. However, unified governmentwide guidance for overseeing information security of contractors and other users with privileged access to federal data and systems has not been issued. We are making recommendations to the Director of OMB to ensure that (1) the FAR update efforts complement agency security management efforts required by FISMA; (2) federal agencies develop policies for information security oversight of contractors and other users with privileged access to federal data; and (3) agencies review the security of other users with privileged access to federal data and systems. Additionally, we are making recommendations to the Secretary of Commerce to develop a unified set of guidance to assist agencies in developing appropriate information security policies for managing risks related to contractors and other users with privileged access to federal data and systems. In commenting on a draft of this report, OMB officials provided oral comments that generally agreed with the results of this report. Additionally, the Deputy Secretary of Commerce provided written comments that agreed with our findings and stated that the department is planning to develop a consolidated framework for contractor-related guidelines. Background: The U.S. government is one of the largest users and acquirers of data, information, and supporting technology systems in the world, and plans to invest approximately $65 billion annually on IT. These investments include the acquisition of IT services and systems from thousands of contractors.[Footnote 3] The ability to contract for technology services can allow an agency to obtain or offer enhanced services without the cost of owning the required technology or maintaining the human capital required to deploy and operate it. The systems and services provided by contractors include computer and telecommunication systems and services, as well as the testing, quality control, installation, and operation of computer equipment. Additionally, contractors provide services and systems to agencies by: * providing IT services and systems at agency facilities; * providing IT services and systems on behalf of the agency at contractor facilities; * providing IT services and systems to an agency via remote access; and: * developing or maintaining IT systems or software. In its fiscal year 2001 report to Congress on federal government information security reform, OMB identified poor security oversight of contractor-provided IT systems and services as a common governmentwide challenge. In that report, OMB stated that IT contracts should include adequate security requirements, but that many agencies had reported no security controls in contracts or no verification that contractors fulfill any requirements that are in place. Federal Law and Policy Address Planning and Oversight for Information Security: Information security is an essential component of the acquisition, development, management, and oversight of IT systems and services delivered by contractors. When relying on contractors, a federal agency transfers operational responsibilities for performing one or more IT service(s) to one or more external providers. However, the overall responsibility and accountability for securing the information and systems remains with the federal agency (see fig. 1). Figure 1: Federal Sources for Addressing Information Security Oversight of Contractor-Delivered IT Systems and Services: [See PDF for image] [End of figure] As depicted in figure 1, federal sources for addressing information security oversight of contractor-delivered IT systems and services are as follows: * FAR: emphasizes basic planning for the acquisition process;[Footnote 4] * FISMA: requires an agencywide information security program that extends to contractors and other users with privileged access to federal data and systems;[Footnote 5] and: * NIST standards and guidance and OMB guidance: assist agencies in establishing necessary security programs. The FAR Emphasizes Planning and Includes Certain Information Security Requirements: The FAR emphasizes planning and includes certain specific information security requirements and provides the primary regulation for federal executive agencies in their acquisition of IT supplies and services with appropriated funds. Additionally, in implementing federal privacy requirements, agencies are to ensure that contracts for the design, development, or operation of records systems using commercial IT services or support services include the following: * agency rules of conduct that the contractor and the contractor's employees shall be required to follow; * a list of the anticipated threats and hazards that the contractor must guard against; * a description of the safeguards that the contractor must specifically provide; and: * requirements for a program of government inspection during performance of the contract that will ensure the continued efficacy and efficiency of safeguards and the discovery and countering of new threats and hazards. The FAR requires agencies to ensure that IT contracts address privacy protections in accordance with the Privacy Act.[Footnote 6] FISMA Implementation Extends to Federal Contractors and Others: FISMA requires each agency to develop, document, and implement an agencywide information security program to protect information and information systems, including those provided or managed by another agency, contractor, or accessed by other users with privileged access to federal data. Specifically, this information security program is to include the following: * periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; * risk-based policies and procedures that cost-effectively reduce information security risks to an acceptable level and ensure that information security is addressed throughout the life cycle of each information system; * subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems; * security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency; * periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency's required inventory of major information systems; * a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; * procedures for detecting, reporting, and responding to security incidents; and: * plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. Federal agencies' implementation of FISMA requirements extends to contractors that are delivering IT systems and services and to other users of federal data and systems.[Footnote 7] In addition to these requirements, FISMA requires each agency to develop, maintain, and annually update an inventory of major information systems operated by the agency or that are under its control. This inventory is to include an identification of the interfaces between each system and all other systems or networks, including those operated by or under the control of contractors or other users with privileged access to federal data. FISMA also requires each agency to have an annual independent evaluation of its information security program and practices, including control testing and compliance assessment. Evaluations of nonnational security systems are to be performed by the agency inspector general or by an independent external auditor. Furthermore, for nonnational security systems, FISMA requires NIST to develop (1) standards to be used by all agencies to categorize all of their information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels; (2) guidelines recommending the types of information and information systems to be included in each category; and (3) minimum information security requirements for information and information systems in each category. NIST Standards and Guidance and OMB Guidance Support FISMA Implementation: NIST standards and guidance and OMB guidance both support agency efforts to implement FISMA. NIST has issued a number of information security standards and guidance that is intended to promote the security of federal IT systems and services, such as its guidance on conducting risk assessments and on the format and content of security plans.[Footnote 8] In addition, as part of its statutory responsibilities under FISMA, NIST has issued standards and guidance that include consideration of security oversight of contractor-provided IT systems and services and other users with privileged access to federal data and systems. In its fiscal year 2004 FISMA reporting guidance,[Footnote 9] OMB required federal agencies to use NIST SP 800-26 or an equivalent assessment tool for agency annual information security reviews.[Footnote 10] The self assessments were also to be used to evaluate the security of contractor-provided IT systems and services. The self assessments provide a method for agency officials to determine the current status of their information security programs and, where necessary, to establish a target for improvement. Federal Agencies Face a Range of Risks from Contractors and Other Users of Federal Data and Systems: Federal agencies face a range of risks from contractors and other users with privileged access to federal data and systems. Contractors that provide systems and services or other users with privileged access to federal data and systems can introduce risks to agency information and systems. Most agencies recognize the contractor-related risks, including those associated with contractor software development and off- site operations. Further, agencies view users with privileged access to federal systems and data as potential sources of risk. Contractors and Other Users of Federal Data and Systems Introduce Risks to Agencies: Contractors and other users with privileged access to federal data and systems can introduce information security risks to federal information and information systems that are sometimes difficult to quantify. Examples of these risks are as follows. Strategic. Two basic strategic risks include management inexperience in overseeing contractor/other organization operations and the potential for inaccurate contractor/other organization information to negatively impact agency decisions. For example, inadequate management experience and expertise can impede an agency's ability to understand and control key risks. Additionally, inaccurate information from a contractor/other organization may prevent the leadership of an organization from having the necessary data to make well-informed strategic decisions. Reputation. Errors, delays, system failures, or unauthorized disclosure of information may negatively impact how citizens, state and local governments, and other federal agencies view an agency and its services or mission. Legal/Compliance. Federal agencies are required to ensure that their information security programs are being applied to systems and services that are being provided by contractors/other organizations and ensure compliance with laws such as privacy protections. Implementation. Initiating a contractor relationship may require a complex transition of people, processes, hardware, software, and other assets from the agency to the provider or from one provider to another, all of which may introduce new risks. Ownership/Dependence. An agency may ignore certain security issues due to "out of sight, out of mind" thinking, having delegated this concern to the provider. An agency may also become dependent on a particular contractor. Operational. In addition to fraud or error, contractor or privileged access information security weaknesses could negatively impact agency operations, including delivering products; managing information; maintaining operations and transaction processing; customer service; systems development and support; and internal control processes. Shared Environment. Contractors may use one system to service multiple clients and, as a result, this system-sharing may pose more risks than an in-house environment. For example, sharing a common network or a processing environment, such as a general purpose server, across multiple clients can increase the likelihood of one organization having access to the sensitive information of another. The risks identified can present complex challenges to federal agencies. Many of the complexities stem from risks related to people, processes, or technologies that, if not properly overseen or managed, can potentially harm an agency's operations, information, or systems. Most Agencies Recognize Contractor-Related Risks to Information: Most agencies (17 of 24) reported that they recognize contractor risks to their information and information systems. These people, process, and technology risks can degrade or diminish the confidentiality, integrity, and availability of agency information systems or data. Examples of agency-identified risks are summarized in table 1. Table 1: Examples of Agency-Identified Risks to Federal Systems and Data Resulting from Reliance on Contractors: Category: People; Risk description: Unauthorized personnel having physical access to agency IT resources (including systems, facilities, and data). Category: People; Risk description: Unauthorized personnel having electronic access to agency IT resources (including systems and data). Category: People; Risk description: Increased use of foreign nationals. Category: People; Risk description: Contractor or privileged users of federal data and systems who may not receive appropriate, periodic background investigations. Category: People; Risk description: Inadequate segregation of duties (e.g., software developer is the same individual who puts the software into production). Category: Processes; Risk description: Failure by contractor or privileged users of federal data and systems to follow agency IT security requirements. Category: Processes; Risk description: Possible disclosure of agency-sensitive information to unauthorized individuals or entities. Category: Processes; Risk description: Lack of effective compliance monitoring of contractors performing work off-site or privileged users of federal data and systems. Category: Processes; Risk description: Contractor or privileged users of federal data and systems may have ineffective patch management processes. Category: Technology; Risk description: Incorporation of unauthorized features in customized application software. For example, a third-party software developer has the potential to incorporate "back doors," spyware, or malicious code into customized application software that could expose agency IT resources to unauthorized loss, damage, modification, or disclosure of data. Category: Technology; Risk description: Encryption technology may not meet federal standards. Category: Technology; Risk description: Intentional or unintentional introduction of viruses and worms. Source: GAO analysis of federal agencies' survey response data. Note: The various risks identified in table 1 could represent multiple risks (i.e. risks in one or more of the identified categories of people, processes and technology). [End of table] In addition to the risks identified in the table, agencies identified specific risks from contractor software development activities and off- site operations. These risks include the following: * a poor patch management process could impact federal operations, such as agency Web sites; * the hosting infrastructure may not separate customer and company data; and: * the need for oversight at an off-site facility. Without proper controls, the risks associated with software development and work performed off site could be very damaging to federal information and systems. For example, loss of confidentiality, integrity, or availability of data can disrupt federal operations and services and may impede the ability to ensure the performance of mission-critical functions. Agencies Assess Users with Privileged Access to Federal Data and Systems as Potential Risks: Many agencies reported their risks from other users with privileged access to federal data and systems. Seventeen agencies indicated that they assess the risks posed by other users with privileged access to federal data and systems. Agency-identified risks included: * lack of controls on network connections; * unauthorized use or release of information, such as grantee information being revealed to another grantee; * malicious activity that introduces viruses and worms; and: * poor electronic access controls that could permit customer passwords to be compromised and exploited by identity theft. Of the remaining 7 agencies, 5 indicated that other users do not possess or use their data and systems; 1 indicated that it had not assessed risks of other users with privileged access; and the other agency did not respond regarding whether they had assessed risks of other users with privileged access to federal data and systems. Agencies Use Various Methods for Overseeing Contractor Security: Federal agencies report using three primary methods for overseeing the information security of contractors: * using contract language to establish information security requirements for contractors; * having information security policies for contractors and other users with privileged access to federal data; and: * using NIST self-assessment tools to assess contractor security capabilities and assess the security implemented by other users with privileged access to federal data. These methods can be leveraged for effective agency oversight of contractors and privileged users for federal systems and data. However when not properly implemented, each of these methods has limitations. Agencies Use Contract Language to Establish Information Security Requirements: Most agencies report using contract language to establish information security requirements for contractors. The FAR requires that agencies use specific contract language related to privacy or security safeguards. Table 2 contains an example of FAR-provided language for agencies to include in their IT contracts. Table 2: The FAR Privacy or Security Safeguards Contract Language: (a) The Contractor shall not publish or disclose in any manner, without the Contracting Officer's written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. (b) To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor's facilities, installations, technical capabilities, operations, documentation, records, and databases. (c) If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. Source: Federal Acquisition Regulation 52.239-1. [End of table] This FAR language helps ensure that federal agencies can maintain access to contractor facilities in order to perform security oversight functions. However, this language does not address all aspects of security. For example, the clause in table 2 does not apply to subcontractors. By not including subcontractors within specific information security requirements, agencies can be introducing significant risks without a contractual tool with which to manage them. More importantly, the FAR has not been amended to reflect the requirements of the FISMA. As a result, the language in the FAR does not reflect key FISMA requirements, including: * periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices performed with a frequency depending on risk, but not less than annually, and including testing of management, operational, and technical controls for every system identified in the agency's required inventory of major information systems; * a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; * procedures for detecting, reporting, and responding to security incidents; and: * plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. The FAR provides, however, that this contract language only needs to be "substantially the same" as standard FAR clauses and agencies, therefore, have the flexibility to modify it to address FISMA requirements. Additionally, agencies are authorized to include in their agency FAR supplements, regulations, and clauses that supplement FAR policies and procedures or satisfy specific needs of the agency.[Footnote 11] Agency FAR supplements, accordingly, could include additional language to address the requirements of FISMA. However, although some agency FAR supplements include requirements related to IT security that are not in the FAR, no agency has made a comprehensive effort to revise its FAR supplement to reflect FISMA. The 2003 NIST SP 800-35[Footnote 12] stresses the importance of establishing security requirements with external parties in formal contracts. However, by not establishing clear security requirements in contracts, agencies may not be able to ensure that their agency information is secured in accordance with FISMA. Most Agencies Have Information Security Policies for Contractors, but Few Policies Provide for Oversight Capabilities: Although most agencies reported having written policies that addressed information security for contractor-provided IT services and systems and for other users with privileged access to federal data and systems, few established specific policies for overseeing the information security practices of contractors to ensure compliance with contract requirements and agency information security policies. As figure 2 illustrates, 22 of the surveyed agencies reported having information security policies for contractors, and 15 reported having policies for other users with privileged access to federal data and systems. However, the majority of agencies addressed contractors and other users with privileged access to federal information and systems within the general scope of their agency policy, and did not define information security oversight requirements. For example, agency policies did not describe oversight methods; the frequency of reviews or assessments; key management controls to mitigate unauthorized disclosure of information; physical/logical access controls; or the introduction of unauthorized features. Further, most of the agencies did not have policies or provide guidance on key areas, including control of agency data in an off-site facility or requirements for interconnection security agreements.[Footnote 13] Figure 2: Major Agencies with Security Policies for Contractors, Privileged Users of Federal Data and Systems, and Contractor Security Oversight: [See PDF for image] [End of figure] However, we identified only 5 agencies that had established specific policies addressing contractor information security oversight. While the five agency policies reflected a broad range of maturity levels, they included many of the following elements: * establishing procedures for contractor information security oversight; * assigning roles and responsibilities; * creating specific audit plans for systems and facilities; * describing interconnection security agreements; * creating requirements for agency information that will be secured at contractor facilities--including storing, processing, and transmitting on contractor systems, background checks, and facility security; and: * requiring agency officials to conduct reviews to ensure that IT security requirements were being enforced. By establishing oversight policies that address these elements, agencies can more consistently oversee contractor security and ensure that contractors and other users with privileged access to federal systems and data comply with agency security requirements. However, without such policies, oversight efforts can be impeded. In fiscal years 2003 and 2004, many agency inspectors general cited the lack of agency policies and guidance regarding how agency program managers or organizational components should conduct oversight of contractor operations as problematic. Three different agency inspectors general reported the following: * Agency policies and procedures did not provide organizational components with guidance on conducting reviews of their contractor- provided services. Further, there was little evidence that components are ensuring that contractor-provided services are secure and comply with agency security policy. * Agency program officials had not ensured that (1) adequate security of contractor-provided services, including not identifying the full range of services provided and that (2) oversight processes and procedures for ensuring secure operations had not been defined or implemented. * Agency officials were not using adequate methods to ensure that contractor security met the requirements of FISMA, OMB, and NIST guidelines after reviewing the access controls, security clearances, and security awareness training for contractors that provide network administration, systems development, and systems administration. Without appropriate policies and guidance, agencies may not be able to effectively and efficiently assess the security of contractor operations or that of other users with privileged access to federal data and systems. For example, without specific oversight policies establishing when and how agencies will review contractor-operated systems, officials responsible for the systems may not be taking sufficient action to ensure that security requirements are being met. Further, information system controls needed to ensure secure operations may not be tested on regular intervals. As a result, agencies may not be able to protect federal information in accordance with FISMA. Agencies Use Self-Assessment Tool to Review Contractor Security, but Its Oversight Value May Be Limited: The majority of agencies reported using a self-assessment tool to review contractor information security, but the oversight value may be limited. NIST's self-assessment guide states that self-assessments provide a method for agency officials to determine the current status of their information security programs and, where necessary, to establish a target for improvement. NIST SP 800-26 structures the questionnaire by management, operational, and technical controls. The section on technical controls does not require testing of those controls as part of the self-assessment, but instead relies on documentation. In response to our survey, 22 agencies reported using NIST SP 800-26 to assess contractors providing IT services and systems and 2 agencies reported not using this assessment tool. While most agencies reported using NIST SP 800-26, the self-assessment tool may have limited value in overseeing contractor information security. For example, by relying on a contractor's self assessment, an agency official may not obtain a clear understanding of the effectiveness of security controls or be assured of the validity of the responses without independent testing. Further, the agency chief information officer or inspector general may have trouble conducting an analysis or review of the self assessment if there is not sufficient documentation. As an example of the self-assessment challenges, one agency inspector general found significant problems with the agency's self assessment. The inspector general noted that, after reviewing a sample of the agency's NIST SP 800-26 self assessments, (1) security weaknesses had not been properly defined, (2) variations existed between inspector general and agency scoring on the NIST SP 800-26 reviews, and (3) the agency did not verify the results of self assessments. Further, the lack of information security requirements established in contracts and the absence of agency oversight policies may diminish the efforts of reviewers using NIST SP 800-26 because they may not be able to refer to clear criteria with which to assess systems' security. As a result, agencies may not obtain an accurate status of the security of contractor-provided systems and services. Many Agencies Do Not Review Other Users with Privileged Access to Federal Data and Systems: In August 2004, OMB mandated the use of NIST SP 800-26 for agency annual system reviews. However, in response to our survey, only 10 agencies reported using NIST SP 800-26 to assess other users with privileged access to federal data and systems that have connectivity to agency networks. By not assessing and testing the security controls of other users with privileged access to federal data, agencies reported that they are at increased risk of losing control of network connections, experiencing unauthorized use of information, such as grantee information being revealed to another grantee, and malicious activity that introduces viruses and worms. Administration Efforts to Improve Information Security of Contractors Continue, but Challenges Remain: The administration is making efforts to improve information security over contractors, but challenges remain. For example, the information security requirements in FAR are being revised and OMB continues to gather data from the agencies about the number of contractor facilities reviewed by agencies. Additionally, NIST has issued guidance, parts of which address some contractor security issues. Federal Acquisition Regulation Is Being Updated to Modernize IT Requirements: In response to the administration's plans to update FAR, officials at the FAR Council stated that the acquisition regulation was being updated to address information security requirements of contractor- provided systems and services. Officials further explained that the administration had been working on updating the FAR language since 2002 when FISMA was enacted. According to the FAR Council officials, the council had completed the majority of its work in December 2004. As of March 2005, the FAR amendments were undergoing legal review. OMB Collects Data on Agency Information Security Oversight of Contractors, but Effectiveness of Agency Efforts Is Unclear: Through its FISMA reporting requirements, OMB continues to gather information about agency oversight of contractors, but understanding the effectiveness of agency efforts based on the collected data is unclear. On an annual basis, OMB collects information from the agencies about: * the total number of agency systems, including whether the chief information officer and the inspectors general agree on the number of systems identified and: * the number of contractor facilities and operations identified and reviewed using NIST SP 800-26 or an equivalent methodology. The fiscal year 2004 FISMA submissions revealed significant discrepancies in the responses from the agency and the inspector general. For example, as shown in table 3, the number of systems reported as being agency systems or contractor systems varied significantly among the chief information officers and the inspectors general at four agencies. Without a clear understanding of who has operational control of a system, agencies cannot ensure that the appropriate oversight and security controls are being implemented in accordance with agency policy. Table 3: Number of Contractor Facilities and Operations Reported in Fiscal Year 2004: Agency: Agency A; Agency/chief information officers total: 61; Inspectors general total: 13. Agency: Agency B; Agency/chief information officers total: 11; Inspectors general total: 65. Agency: Agency C; Agency/chief information officers total: 4; Inspectors general total: 111. Agency: Agency D; Agency/chief information officers total: 20; Inspectors general total: 5. Source: Fiscal year 2004 agency chief information officer and inspectors general FISMA submissions to OMB. [End of table] Over the past 3 years, there has been a decline in both the number of contractor facilities identified by the agencies and the number of facilities reviewed by the agencies. Figure 3 depicts this trend in 23 of the major agencies. Figure 3: Total Contractor Facilities and Number of Facilities Reviewed for 23 Federal Agencies in Fiscal Years 2002-2004: [See PDF for image] Note: The Department of Defense (DOD) contractor facilities and number of facilities reviewed are not reflected in the figure because this information was not available for 2002. However, in 2003, the DOD reported identifying 4,716 contractor facilities and reviewing 4,000 facilities, while in 2004, the department inventoried 4,686 and reviewed 3,961 facilities. [End of figure] The disagreement between agency chief information officers and inspectors general about whether systems are deemed to be agency systems or contractor systems can impede effective and efficient information security oversight efforts. In some cases, it may even result in systems not being reviewed. By not performing reviews of contractor-operated facilities, agencies cannot ensure that their information is being protected in accordance with FISMA and, as a result, federal operations and data can be at risk. The data gathered from the agencies on the number of contractor systems identified and reviewed do not provide an accurate measure of the effectiveness of agency information security oversight of contractors. However, additional data about the contracts, policies, and self assessments could provide a better measure of effectiveness. For example, asking inspectors general to determine: * what portion of the contractor systems identified by the agencies have specific IT security language that addresses key FISMA elements; * if the agency information security policies provide specific oversight policies for contractors and privileged users of federal systems and data; and: * whether the required NIST SP 800-26 assessments of contractor systems were completed by the agency, the contractor, or an independent entity. Finally, annual agency reports required by FISMA do not address security related to other users with privileged access to federal data. There is not a clear governmentwide understanding of how agencies are addressing the various challenges and identified risks related to other users with privileged access. As previously discussed, agencies have not developed policies or reviewed the controls necessary to ensure that these users of federal data do not place agencies' information and systems at risk of compromise. As a result, federal agencies that lack appropriate controls and oversight can be exposing their information and systems to additional risks from privileged users who might introduce malicious code, disclose unauthorized information, or lack controls to secure their network interfaces with the agency systems. Unified Federal Guidance Could Assist Agencies: No single federal guide exists for federal agencies to rely on when addressing information security over contractors. FISMA requirements apply to all federal contractors and organizations or sources that possess or use federal information or that operate, use, or have access to federal information systems on behalf of an agency. In support of FISMA implementation, NIST has issued a number of information security products intended to improve federal IT systems. However, in the absence of a single, comprehensive guide to assist in the development of policies, agencies must refer to portions of several different documents that address elements related to contractor information security oversight. For example, in 2005, NIST published Recommended Security Controls for Federal Information Systems,[Footnote 14] which refers to portions of the following documents that can be used by agencies to address some of the challenges related to information security oversight of contractors: * SP 800-18 states that agencies may require compliance with the guide as part of contract requirements; * SP 800-35 lists in its appendices sample acquisition language that is appropriate for inclusion into IT security service statements of work; * SP 800-47 discusses, in brief, the development of non-disclosure agreements for contractors when determining interconnection requirements; and: * 800-64 gives examples of contract clauses that can be used to help establish clear lines of authority and responsibility. In February 2005, NIST released the Federal Information Processing Standard 201 entitled Personal Identity Verification of Federal Employees and Contractors. This standard was developed in response to Homeland Security Presidential Directive 12 and is intended to improve the identification and authentication of federal employees and contractors for access to federal facilities and information systems. This standard helps to address the risk of contractors gaining unauthorized physical or electronic access to federal information. Unified guidance on addressing the information security oversight of contractors and privileged users of federal systems and data could assist agencies in developing effective programs to ensure compliance with agency policy. However, without clear guidance on how to develop effective information security oversight of contractors and users with privileged access to federal systems and data, federal agencies may not develop sufficient policies to address the range of risks posed by contractors and key users. As a result, federal information and operations can be placed at undue risk. Conclusions: Contractors provide valuable services that contribute to the efficient functioning of the government, but a range of risks from contractors and other users with privileged access to federal data and systems must be managed effectively. Contracts, policies, and security self- assessments can be leveraged as valuable oversight tools for federal agencies in managing oversight of contractors and other users. However, when not properly implemented, each of these methods has limitations. For example, many agencies are not incorporating FISMA requirements into their contract language; accordingly, their strongest tool for establishing information security requirements is limited. Additionally, many agencies have not defined specific oversight policies for contractors and other users with privileged access to federal data. Without clearly defined information security oversight policies, agencies may be accepting significant risk to their information and systems from both contractors and other users with privileged access without having the appropriate controls to mitigate the risks. Finally, agency reliance on self-assessment tools may not provide them with the appropriate tools to ensure the security of their information. To address these complex challenges, a variety of administration efforts have been started to further enhance federal agencies' efforts to improve information security oversight of contractors, but challenges remain. For example, the effort to update FAR guidance has not been completed. In addition, continuing OMB FISMA oversight reveals challenges in contractor oversight. Finally, if agencies lack unified guidance to assist them in creating appropriate information security oversight policies for contractors and other users with privileged access to federal data and systems, federal agencies may not be able to effectively protect their information. Recommendations for Executive Action: To ensure that agencies are developing the appropriate information security oversight capabilities for contractors and other users with privileged access to federal data and systems, we recommend, in accordance with FISMA, that the Director of OMB ensure that the following two actions take place. * Efforts to update FAR are completed expeditiously and that such efforts require agency security management efforts required by FISMA, including: * periodic testing and evaluation of management, operational, and technical controls; * a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies and procedures; * procedures for detecting, reporting, and responding to security incidents; and: * plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. * Federal agencies develop policies for ensuring information security of contractors and other users with privileged access to federal data, including: * establishing procedures for contractor information security oversight; * assigning roles and responsibilities; * creating specific audit plans for systems and facilities; * describing interconnection security agreements; * creating requirements for agency information that will be secured at contractor facilities including storing, processing, transmitting on contractor systems, background checks, and facility security; and: * requiring agency officials to conduct reviews to ensure that IT security requirements are being enforced. To assist agencies in managing the risks related to contractors and other users with privileged access to federal data and systems, we recommend that the Secretary of Commerce develop a unified set of guidance for developing appropriate information security policies. Agency Comments on Our Evaluation: We provided a draft of this report to OMB and the Department of Commerce for their official review and comment. OMB General Counsel provided oral comments on the report, which have been incorporated as appropriate. OMB generally agreed with the report findings and conclusions. OMB officials told us that, as part of the capital asset plan and business case development process, agencies are required to answer several information security oversight questions related to contractor-provided IT systems and services. These questions provide OMB important information when assessing the business case for funding. Further, OMB stated that their efforts to enhance oversight of contractors includes requiring that the 25 E-Government initiatives be independently reviewed to determine compliance with IT security requirements. OMB did not disagree with the overall recommendations and recognized the need for further agency action to address contractor security oversight. In written comments, which are reprinted in appendix II, the Deputy Secretary of the Department of Commerce acknowledged the accuracy of the report. In regard to our recommendation, Commerce stated that NIST recognizes the importance of providing guidance to assist agencies in ensuring that security requirements are applied by contractors. Additionally, NIST has developed publications that can be used for contractors and are focused on acquisition, assessments, controls, and the system development life cycle. Commerce agreed that through NIST, it would develop a strategy to build a framework for a consolidated delivery of contractor related-guidelines. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to interested congressional committees; the Director, Office of Management and Budget; and the Secretary, Department of Commerce. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at [Hyperlink, http://www.gao.gov]. If you or any of your staff have any questions concerning this report, please contact me at (202) 512-3317. I can also be reached by e-mail at [Hyperlink, wilshuseng@gao.gov]. Other contacts and key contributors to this report are listed in appendix III. Signed by: Gregory C. Wilshusen: Director, Information Security Issues: [End of section] Appendixes: Appendix I: Objectives, Scope, and Methodology: The objectives of our review were to: * Describe the information security risks associated with the federal government's reliance on contractors providing information technology systems and services and other users with privileged access to federal data and systems federal information or access federal information systems. * Identify methods used by federal agencies to ensure security of information and information systems that are operated, used, or accessed by contractors and other users with privileged access to federal data. * Discuss what steps the administration is taking to ensure implementation and oversight of security of information and information systems that are operated, used, or accessed by contractors and other users with privileged access to federal data. To describe the information security risks associated with the federal government's reliance on contractors and other organizations, we analyzed existing federal regulations, laws, and guidelines such as the Federal Acquisition Regulation (FAR); Federal Information Security Management Act of 2002 (FISMA); and National Institute of Standards and Technology (NIST) guidance. In addition, we interviewed federal and private-sector officials regarding the policies and procedures for overseeing contractor security. We then developed a series of questions that were incorporated into a Web-based survey instrument. We pretested our survey instrument at one federal department and one federal independent agency. We also met with Office of Management and Budget (OMB) officials to discuss OMB's role in ensuring the security of contractor-provided systems and services. For each agency to be surveyed, we identified the office of the chief information officer, notified each office of our work, and, via e-mail, distributed a link to each office. All 24 agencies responded to our survey. We did not verify the accuracy of the agencies' responses; however, we reviewed supporting documentation that agencies provided to validate their responses. We contacted agency officials when necessary for follow-up. Although this was not a sample survey and, therefore, there were no sampling errors, conducting any survey may introduce errors, commonly referred to as nonsampling errors. For example, difficulties in how a particular question is interpreted, in the sources of information that are available to respondents, or in how the data are entered into a database or were analyzed can introduce unwanted variability into the survey results. We took steps in the development of the survey instrument, the data collection, and the data analysis to minimize these nonsampling errors. For example, a survey specialist designed the survey instrument in collaboration with GAO staff with subject-matter expertise. Then, as previously stated, it was pretested to ensure that the questions were relevant, clearly stated, and easy to comprehend. When the data were analyzed, a second, independent analyst checked all computer programs. Because this was a Web-based survey, respondents entered their answers directly into the electronic questionnaire. This eliminated the need to have the data keyed into a database, thus removing an additional potential source of error. To identify methods used by federal agencies to ensure security of contractor-provided systems and services, we interviewed the FAR Council, OMB, and NIST officials to discuss their guidelines and other tools available to agencies. In addition, questions regarding agency policy, agency use of oversight guidelines, acquisition process, and personnel/background checks, security requirements, and contract language were included in the survey we sent to the 24 Chief Financial Officer's Act agencies. We did not verify the accuracy of the agencies' responses; however, we reviewed supporting documentation that agencies provided to validate their responses. We contacted agency officials when necessary for follow-up. Finally, to determine what steps the administration is taking to ensure implementation and oversight of security of contractors and other users with privileged access that operate, use, or access federal information systems on behalf of an agency, we interviewed FAR Council, OMB, and NIST officials regarding the policies and procedures for overseeing contractor security. We also reviewed annual chief information officer and inspectors general FISMA reports to assess progress made in meeting FISMA requirements related to contractor security. We conducted our work in Washington, D.C., from August 2004 through March 2005 in accordance with generally accepted government auditing standards. [End of section] Appendix II: Comments from the Department of Commerce: THE DEPUTY SECRETARY OF COMMERCE: Washington, D.C. 20230: April 19, 2005: Mr. Gregory Wilshusen: Director, Information Security Issues: United States Government Accountability Office: Washington, DC 20548: Dear Mr. Wilshusen: I enclose the Department of Commerce's comments on Government Accountability Office (GAO) proposed report entitled Information Security: Improving Oversight of Access to Federal Systems and Data by Contractors Can Reduce Risk (GAO-05-362). Thank you for the opportunity to review the report. I commend the GAO for this study on the issue of improving information security oversight of contractors. We recognize the need to develop cohesive government-wide guidance to assist agencies in developing appropriate information security policies for addressing contractors and other users with privileged access to federal data and systems. The National Institute of Standards and Technology (KIST) has developed a set of publications for acquisition, self-assessment, and controls that should be applied in developing information systems. In addition, NIST has recently developed a road map which maps NIST publications to the various phases of the system development life cycle. In support of the GAO proposed recommendation, NIST will extend its efforts to develop a strategy to build the necessary framework for a more consolidated delivery of the contractor related guidelines. Again, thank you for the opportunity to comment on this draft report. Sincerely, Signed by: Theodore W. Kassinger: Enclosure: Comments on Government Accountability Office (GAO) Report entitled "Information Security: Improving Oversight of Access to Federal Systems and Data by Contractors Can Reduce Risk" made by the National Institute of Standards and Technology (KIST), Department of Commerce: The GAO team should be commended for the study. The report provides a thorough assessment of the information security risks associated with the Federal Government's reliance on contractor-provided IT systems and services and other users with privileged access to federal data and systems. Furthermore, it identifies current methods employed by federal agencies to avoid these risks, and provides recommendations to improve information security oversight for contractors. NIST has reviewed the report and has noted no major errors or omissions. The report identified one major recommendation --that the Secretary of Commerce develop a unified set of guidance for developing appropriate information security guidance related to contracting. NIST recognizes the importance of providing guidance to assist agencies in ensuring that the appropriate security requirements are applied to contractors. We had previously developed a three-volume set of special publications (SP) specifically focused on acquisition (SP800-64, SP800- 35, and SP800-36). In addition, SP 800-26, the NIST self-assessment tool, can be used for contractor assessments. Most recently, NIST published SP800-53 which defines in great detail the controls that should be applied in developing information systems. This document can be used to derive security requirements for systems being developed by contractors. (http://csrc.nist.gov/publications/nistpubs/index.html) Further, recognizing the need to provide one consolidated road map to the numerous NIST publications, which can be applied throughout the system development life cycle (SDLC), we recently published a reference which maps all of the NIST guidance to the various phases of the SDLC. It can be used by contractors to identify the appropriate references based on scope and focus of specific contract tasking. (http://csrc.nist.gov/SDLCinfosec/SDLC_brochure_Aug04.pdf) The above strategy has allowed NIST to develop information security publications in focused areas with the sufficient detail required to be useful. To support the GAO proposed recommendation, NIST will extend its efforts to develop a strategy to build the necessary framework for a more consolidated delivery of the contractor-related guidelines. [End of section] Appendix III: GAO Contact and Staff Acknowledgments: GAO Contact: J. Paul Nicholas, Assistant Director, (202) 512-4457, [Hyperlink, nicholasj@gao.gov]. Staff Acknowledgments: In addition to the individual named above, key contributors to this report included Neil Doherty, Nancy Glover, Stuart Kaufman, Anjalique Lawrence, Nnaemeka Okonkwo, and Kevin Secrest. (310544): FOOTNOTES [1] These 24 CFO departments and agencies are the Departments of Agriculture, Commerce, Defense, Education, Energy, Health and Human Services, Homeland Security, Housing and Urban Development, Interior, Justice, Labor, State, Transportation, Treasury, Veterans Affairs, Environmental Protection Agency; General Services Administration; National Aeronautics and Space Administration; National Science Foundation; Nuclear Regulatory Commission; Office of Personnel Management; Small Business Administration; Social Security Administration; and U.S. Agency for International Development. [2] A virus is a program that "infects" computer files, usually executable programs, by inserting a copy of itself into the file. These copies are usually executed when the infected file is loaded into memory, allowing the virus to infect other files. A virus requires human involvement (usually unwittingly) to propagate. A worm is an independent computer program that reproduces by copying itself from one system to another across a network. Unlike computer viruses, worms do not require human involvement to propagate. [3] Contractors are generally considered to be the primary entity with which a department or agency enters into an agreement. In this report, we use the term "contactor" when referring to both contractors and subcontractors. We refer to other organizations that possess or use federal information or have access to federal information systems--such as grantees, state and local governments, and research and educational institutions--as other users with privileged access to federal data and systems. [4] 48 C.F.R. Chapter 1. [5] Federal Information Security Management Act of 2002, Title III, E- Government Act of 2002, Pub. L. No. 107-347 (Dec. 17, 2002). [6] Privacy Act of 1974, Pub. L. No. 93-579, 5 U.S.C. 552a; FAR Subpart 24.1, 48 C.F.R. Subpart 24.1. [7] In 2003, the Medicare Prescription Drug, Improvement, and Modernization Act (Pub. L. No. 108-173) was enacted. Section 912 of the act includes a provision requiring Medicare administrative contractors to implement a contractorwide information security program to provide information security for the operation and assets of the contractor for Medicare functions. Additionally, the information security program is required to meet certain requirements for information security programs already imposed on agencies and their data contractors by FISMA. Medicare administrative contractors are also required to undergo an annual independent testing and evaluation of their information security programs. [8] NIST, Risk Management Guide for Information Technology Systems, Special Publication 800-30 (Gaithersburg, Md.: July 2002) and Guide for Developing Security Plans for Information Technology Systems, Special Publication 800-18 (Gaithersburg, Md.: December 1998). [9] OMB, Fiscal Year 2004 Reporting Instructions for the Federal Information Security Management Act, M-04-25(Washington, D.C.: Aug. 23, 2004). [10] NIST, Security Self-Assessment Guide for Information Technology Systems, NIST Special Publication 800-26 (Gaithersburg, Md.: November 2001). [11] FAR Subpart 1.3; 48 C.F.R. Subpart 1.3. [12] NIST, Guide to Information Technology Services, Special Publication 800-35 (Gaithersburg, Md.: October 2003). [13] An interconnection security agreement documents specific technical and security requirements for connecting IT systems from different organizations, such as between a federal agency and a contractor or between a federal agency and other users with privileged access to federal data and systems. [14] NIST, Recommended Security Controls for Federal Information Systems, Special Publication 800-53 (Gaithersburg, Md.: February 2005). GAO's Mission: The Government Accountability Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO's Web site ( www.gao.gov ) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as "Today's Reports," on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select "Subscribe to e-mail alerts" under the "Order GAO Products" heading. Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. Government Accountability Office 441 G Street NW, Room LM Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov Automated answering system: (800) 424-5454 or (202) 512-7470: Public Affairs: Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, D.C. 20548: