GAO urges improvements to FISMA

An auditor recommends steps to improve information security at agencies

Clarifying agencies' information security obligations, requiring agency executives to ensure that their information security programs are effective, and bolstering oversight from the Office of Management and Budget could improve Federal Information Security Management Act programs, according to government auditors.

The recommendations from the Government Accountability Office on how to strengthen FISMA come as senators consider legislation to reform the law. Sen. Thomas Carper (D-Del.) introduced legislation in April designed to improve FISMA, which critics say relies too much on paper compliance reports and doesn’t fully fix security vulnerabilities.

Meanwhile, Gregory Wilshusen, director of information security issues at GAO, told the House Oversight and Government Reform Government Committee's Management, Organization and Procurement Subcommittee in May that many agencies have not fully or effectively implemented key elements of agencywide information security programs, as required by FISMA.

Wilshusen said GAO’s audits and reviews by agencies' inspectors general found significant deficiencies in information security controls that put agency operations and assets at risk. As a follow-up to that May testimony, the subcommittee’s leaders asked Wilshusen for recommendations to improve FISMA.

In a letter to the leaders dated June 30, Wilshusen said GAO recommended:

  • Clarifying requirements for how agencies test and evaluate security controls.
  • Requiring that agency executives include in their annual reports to Congress a statement testifying to the overall adequacy and effectiveness of their information security.
  • Bolstering independent annual evaluations by requiring them to be performed in accordance with accepted government auditing standards.
  • Expanding the data that OMB includes in its annual reports on agency compliance.
  • Improving OMB's oversight of agency information security programs to increase accountability.

About the Author

Ben Bain is a reporter for Federal Computer Week.

Featured

  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.