GAO urges improvements to FISMA

An auditor recommends steps to improve information security at agencies

Clarifying agencies' information security obligations, requiring agency executives to ensure that their information security programs are effective, and bolstering oversight from the Office of Management and Budget could improve Federal Information Security Management Act programs, according to government auditors.

The recommendations from the Government Accountability Office on how to strengthen FISMA come as senators consider legislation to reform the law. Sen. Thomas Carper (D-Del.) introduced legislation in April designed to improve FISMA, which critics say relies too much on paper compliance reports and doesn’t fully fix security vulnerabilities.

Meanwhile, Gregory Wilshusen, director of information security issues at GAO, told the House Oversight and Government Reform Government Committee's Management, Organization and Procurement Subcommittee in May that many agencies have not fully or effectively implemented key elements of agencywide information security programs, as required by FISMA.

Wilshusen said GAO’s audits and reviews by agencies' inspectors general found significant deficiencies in information security controls that put agency operations and assets at risk. As a follow-up to that May testimony, the subcommittee’s leaders asked Wilshusen for recommendations to improve FISMA.

In a letter to the leaders dated June 30, Wilshusen said GAO recommended:

  • Clarifying requirements for how agencies test and evaluate security controls.
  • Requiring that agency executives include in their annual reports to Congress a statement testifying to the overall adequacy and effectiveness of their information security.
  • Bolstering independent annual evaluations by requiring them to be performed in accordance with accepted government auditing standards.
  • Expanding the data that OMB includes in its annual reports on agency compliance.
  • Improving OMB's oversight of agency information security programs to increase accountability.

About the Author

Ben Bain is a reporter for Federal Computer Week.

Featured

Reader comments

Thu, Jul 2, 2009 Fat Cat IRS

Sorry, this sounds like just more paperwork.

FISMA has no teeth.

The solution is not to provide more data to Congress/OMB/GAO etc. but to literaly shut non-compliant systems down after a reasonable time to comply -- In my opinion 18 months. We report weaknesses year after year with Plans of Actions and Milestones (POA&M). When milestones are missed, the systems continue in operation anyway.

Congress issues its annual 'report card' in which most agencies have poor grades. The systems stay online anyway.

OMB, through the E300 process threatens to remove funding from non-compliant systems, but those systems remain in operation. Are they running on air? or on money? from where?

REAL solutions come from real consequences. The current FISMA processes and paperwork are more than enough to identify and quantify systems' weaknesses. We know what they are, but we write explanations instead of doing actual work.

Thu, Jul 2, 2009

The title of this article should read "GAO urges improvements to Agencies use of FISMA". No statutory changes to FISMA are required, simply agencies actually following the risk management process contained therein. Even the much praised CAG Guidelines can be incorporated today into the organizational security plan of any agency that wishes to use them. The agencies that actually follow the FISMA risk management approach are seeing real results, while the ones who treat it as a paperwork exercise are crying that "it's just a paperwork exercise"...

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above