Federal Information Security Issues

This letter responds to congressional request that GAO address additional questions arising from the May 19, 2009, hearing on federal information security held by the Subcommittee on Government Management, Organization, and Procurement. In that hearing, we discussed the current state of information security throughout the federal government and agency efforts to comply with the requirements of the Federal Information Security Management Act of 2002 (FISMA). Congress had the following two questions: (1) Please comment on the need for improved cyber security relating to S.773, the proposed Cybersecurity Act of 2009; and (2) Please provide recommendations to improve the Federal Information Security Management Act.