GAO urges improvements to FISMA

An auditor recommends steps to improve information security at agencies

Clarifying agencies' information security obligations, requiring agency executives to ensure that their information security programs are effective, and bolstering oversight from the Office of Management and Budget could improve Federal Information Security Management Act programs, according to government auditors.

The recommendations from the Government Accountability Office on how to strengthen FISMA come as senators consider legislation to reform the law. Sen. Thomas Carper (D-Del.) introduced legislation in April designed to improve FISMA, which critics say relies too much on paper compliance reports and doesn’t fully fix security vulnerabilities.

Meanwhile, Gregory Wilshusen, director of information security issues at GAO, told the House Oversight and Government Reform Government Committee's Management, Organization and Procurement Subcommittee in May that many agencies have not fully or effectively implemented key elements of agencywide information security programs, as required by FISMA.

Wilshusen said GAO’s audits and reviews by agencies' inspectors general found significant deficiencies in information security controls that put agency operations and assets at risk. As a follow-up to that May testimony, the subcommittee’s leaders asked Wilshusen for recommendations to improve FISMA.

In a letter to the leaders dated June 30, Wilshusen said GAO recommended:

  • Clarifying requirements for how agencies test and evaluate security controls.
  • Requiring that agency executives include in their annual reports to Congress a statement testifying to the overall adequacy and effectiveness of their information security.
  • Bolstering independent annual evaluations by requiring them to be performed in accordance with accepted government auditing standards.
  • Expanding the data that OMB includes in its annual reports on agency compliance.
  • Improving OMB's oversight of agency information security programs to increase accountability.

About the Author

Ben Bain is a reporter for Federal Computer Week.

Featured

  • Defense
    The U.S. Army Corps of Engineers and the National Geospatial-Intelligence Agency (NGA) reveal concept renderings for the Next NGA West (N2W) campus from the design-build team McCarthy HITT winning proposal. The entirety of the campus is anticipated to be operational in 2025.

    How NGA is tackling interoperability challenges

    Mark Munsell, the National Geospatial-Intelligence Agency’s CTO, talks about talent shortages and how the agency is working to get more unclassified data.

  • Veterans Affairs
    Veterans Affairs CIO Jim Gfrerer speaks at an Oct. 10 FCW event (Photo credit: Troy K. Schneider)

    VA's pivot to agile

    With 10 months on the job, Veterans Affairs CIO Jim Gfrerer is pushing his organization toward a culture of constant delivery.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.