Skip to main content

Information Security: National Archives and Records Administration Needs to Implement Key Program Elements and Controls

GAO-11-20 Published: Oct 21, 2010. Publicly Released: Oct 27, 2010.
Jump To:
Skip to Highlights

Highlights

The National Archives and Records Administration (NARA) is responsible for preserving access to government documents and other records of historical significance and overseeing records management throughout the federal government. NARA relies on the use of information systems to receive, process, store, and track government records. As such, NARA is tasked with preserving and maintaining access to increasing volumes of electronic records. GAO was asked to determine whether NARA has effectively implemented appropriate information security controls to protect the confidentiality, integrity, and availability of the information and systems that support its mission. To do this, GAO tested security controls over NARA's key networks and systems; reviewed policies, plans, and reports; and interviewed officials at nine sites.

NARA has not effectively implemented information security controls to sufficiently protect the confidentiality, integrity, and availability of the information and systems that support its mission. Although it has developed a policy for granting or denying access rights to its resources, employed mechanisms to prevent and respond to security breaches, and made use of encryption technologies to protect sensitive data, significant weaknesses pervade its systems. NARA did not fully implement access controls, which are designed to prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities. Specifically, the agency did not always (1) protect the boundaries of its networks by, for example, ensuring that all incoming traffic was inspected by a firewall; (2) enforce strong policies for identifying and authenticating users by, for example, requiring the use of complex (i.e., not easily guessed) passwords; (3) limit users' access to systems to what was required for them to perform their official duties; (4) ensure that sensitive information, such as passwords for system administration, was encrypted so as not to be easily readable by potentially malicious individuals; (5) keep logs of network activity or monitor all parts of its networks for possible security incidents; and (6) implement physical controls on access to its systems and information, such as securing perimeter and exterior doors and controlling visitor access to computing facilities. In addition to weaknesses in access controls, NARA had mixed results in implementing other security controls. For example: (1) NARA did not always ensure equipment used for sanitization (i.e., wiping clean of data) and disposal of media (e.g., hard drives) was tested to verify correct performance. (2) NARA conducted appropriate background investigations for employees and contractors to ensure sufficient clearance requirements have been met before permitting access to information and information systems. (3) NARA did not consistently segregate duties among various personnel to ensure that no one person or group can independently control all key aspects of a process or operation. The identified weaknesses can be attributed to NARA not fully implementing key elements of its information security program. Specifically, the agency did not adequately assess risks facing its systems, consistently prepare and document security plans for its information systems, effectively ensure that all personnel were given relevant security training, effectively test systems' security controls, consistently track security incidents, and develop contingency plans for all its systems. Collectively, these weaknesses could place sensitive information, such as records containing personally identifiable information, at increased and unnecessary risk of unauthorized access, disclosure, modification, or loss. GAO is making 11 recommendations to the Archivist of the United States to implement elements of NARA's information security program. In commenting on a draft of this report, the Archivist generally concurred with GAO's recommendations but disagreed with some of the report's findings. GAO continues to believe that the findings are valid.

Recommendations

Recommendations for Executive Action

Agency Affected Recommendation Status
National Archives and Records Administration To help establish an effective information security program for NARA's information and information systems, the Archivist of the United States should update NARA's system documentation and inventory to reflect accurate Federal Information Processing Standard (FIPS) 199 categorizations.
Closed – Implemented
In fiscal year 2014, we verified that NARA, in response to our recommendation, updated NARA's system documentation and inventory to reflect accurate FIPS 199 categorizations.
National Archives and Records Administration To help establish an effective information security program for NARA's information and information systems, the Archivist of the United States should conduct physical security risk assessments of NARA's buildings and facilities based on facility-level and federal requirements.
Closed – Implemented
In fiscal year 2014, we verified that NARA, in response to our recommendation, conducted physical security risk assessments of NARA's buildings and facilities based on facility-level and federal requirements.
National Archives and Records Administration To help establish an effective information security program for NARA's information and information systems, the Archivist of the United States should revise NARA's IT security methodologies, including those for access controls, certification and accreditation, and contingency planning, to include NIST's minimum system control requirements.
Closed – Implemented
In fiscal year 2014, we verified that NARA, in response to our recommendation, revised IT security methodologies to include minimum system control requirements for access controls, assessment and authorization, and contingency planning.
National Archives and Records Administration To help establish an effective information security program for NARA's information and information systems, the Archivist of the United States should include inventory information and roles and responsibilities assignments in system security plans.
Closed – Implemented
In fiscal year 2014, we verified that NARA, in response to our recommendation, included inventory information and roles and responsibilities assignments in system security plans.
National Archives and Records Administration To help establish an effective information security program for NARA's information and information systems, the Archivist of the United States should improve NARA's training process to ensure that all required personnel meet security awareness training requirements.
Closed – Implemented
In fiscal year 2014, we verified that NARA, in response to our recommendation, improved training process to ensure personnel meet security awareness training requirements, including issuing mandatory computer based training notice, procuring a contract to institute an information security awareness course for NARA employees, and alerting staff via e-mail about possible security threats facing the agency.
National Archives and Records Administration To help establish an effective information security program for NARA's information and information systems, the Archivist of the United States should implement a process that ensures all required NARA personnel with significant security responsibilities meet specialized training requirements.
Closed – Implemented
In fiscal year 2014, we verified that NARA, in response to our recommendation, tracked training requirements for employees with significant security responsibilities and procured a contract to institute specialized information security training courses for NARA employees with significant security responsibilities.
National Archives and Records Administration To help establish an effective information security program for NARA's information and information systems, the Archivist of the United States should test management, operational, and technical controls for all systems at least annually.
Closed – Implemented
In fiscal year 2014, we verified that NARA, in response to our recommendation, tested management, operational, and technical controls annually.
National Archives and Records Administration To help establish an effective information security program for NARA's information and information systems, the Archivist of the United States should conduct certification testing when authorizing systems to operate.
Closed – Implemented
In fiscal year 2014, we verified that NARA, in response to our recommendation, conducted certification testing when authorizing systems to operate.
National Archives and Records Administration To help establish an effective information security program for NARA's information and information systems, the Archivist of the United States should update remedial action plans in a timely manner and include required resources necessary for mitigating weaknesses, scheduled completion dates, milestones, and how weaknesses were identified.
Closed – Implemented
In fiscal year 2014, we verified that NARA, in response to our recommendation, updated remedial action plans to include required resources necessary for mitigating weaknesses, scheduled completion dates, milestones, and how weaknesses were identified.
National Archives and Records Administration To help establish an effective information security program for NARA's information and information systems, the Archivist of the United States should improve the incident tracking process to ensure that incidents are appropriately categorized and that personnel responsible for tracking and reporting incidents are trained.
Closed – Implemented
In fiscal year 2014, we verified that NARA, in response to our recommendation, categorized incidents appropriately and trained personnel responsible for tracking and reporting incidents.
National Archives and Records Administration To help establish an effective information security program for NARA's information and information systems, the Archivist of the United States should develop a contingency plan for the system that tracks physical records.
Closed – Implemented
In fiscal year 2014, we verified that NARA, in response to our recommendation, developed a contingency plan for the Holding Management system, which is designed to support physical management of permanent hard copy records.

Full Report

GAO Contacts

Office of Public Affairs

Topics

Access controlConfidential informationInformation securityInformation security managementInformation systemsInternal controlsOperational testingProgram evaluationRecords managementSafeguardsSecurity policiesTestingPolicies and proceduresProgram implementationConfidential communications