Information Security: Securities and Exchange Commission Needs to Address Weak Controls over Financial and Sensitive Data

In fiscal year 2006 we reported that SEC clearly defined the roles and responsibilities of the central security group. SEC has developed, documented, and implemented clearly defined roles and responsibilities of the central security group.

In FY 2007, we verified that SEC designated an individual security staff to provide security oversight at its 11 field offices.

In fiscal year 2007 we verified that SEC developed a process for assessing information security risks, including when significant changes are made to SEC facilities or computer systems.

In fiscal year 2007 we verified that SEC established and implemented agency-wide information security policies and procedures by addressing security requirements for key control areas and developed and implemented security plans for the general support systems and major applications.

In fiscal year 2007 we verified that SEC provided security awareness training to each employee and contractor, and specialized security training to employees and contractors that require such training. SEC has a process to provide security awareness training to employees and contractors and specialized training for employees and contractors that require such training. Further, SEC has a training database to track employee and contractor security training.

In fiscal year 2007 we verified that SEC instituted an ongoing program of tests and evaluations to ensure that policies and controls were appropriate and effective and that corrective action plans addressed identified weakness.