Agencies' cybersecurity grades rise slightly

Although agency grades improved only slightly on the annual IT security report card, the overall security of the government continues to make strides.

The government’s overall information technology security grade rose only slightly according to the latest House Oversight and Government Reform Committee’s score card, released today. But score cards ignore the fact that the overall cyber posture of agencies is so much better than it was a year ago, let alone four years ago, when most departments received failing grades, said an administration official and a key member of Congress. Rep. Tom Davis (R-Va.), ranking member of the committee, said agencies continue to make slow and steady progress across the board to reach a total score of C-, or 72.9 out of 100. Eight agencies received grades of A and eight others received failing grades for their cybersecurity position in 2006, the committee said. Four agencies earned a B and two earned a C. The Veterans Affairs Department did not receive a grade because it did not submit a Federal Information Security Management Act report last year, the committee said. “For those agencies that received an F, they are good, solid F’s,” said Karen Evans, the Office of Management and Budget’s administrator for e-government and information technology. “When we started, we didn’t know where to even start. Now we are doing a better job knowing what we don’t know. I take this overall grade as my own. I would never accept a C for my kids, and I will not accept it as my own grade.” Evans and Davis both attributed the improved score to more agencies completing their systems inventory. OMB reported in its March FISMA report to Congress that 20 agency inventories were at least 80 percent complete, and a majority of those reported that their inventories were 96 percent to 100 percent finished. OMB said this is a decrease of one agency from the number that reported at least 80 percent complete in 2005. “Some agencies are still demonstrating large fluctuations in the number of systems in their inventories, both upwards and downwards,” the OMB report states. But Davis pointed to the Homeland Security Department as one example of an agency completing its inventory and seeing its grade rise. DHS received a D after earning an F the past three years. Still, Davis expressed concern about the grades for DHS and the Defense, State and Treasury departments. DOD, State and Treasury earned Fs. “DOD and DHS are not well-managed agencies,” Davis said. “DHS is dealing with culture issues and DOD is just poorly managed. DOD has a lot of fiefdoms and territory battles.” The Department of Housing and Urban Development is another agency that completed its inventory and saw improvement. HUD earned an A, up from a D last year. Lisa Schlosser, HUD’s chief information officer, credited a heightened security awareness program led by the agency’s chief information security officer, Pat Howard; executive support; and the department's commitment to do more than just comply with FISMA. “Our challenge is to capitalize on technology and improve our security program to address continued threats,” she said. “We got our inspector general to agree that we had a good inventory and process.” To continue to push agencies to improve, Davis said he would offer departments bonus points in next year’s score card if they move to a standard Windows desktop configuration this year. He also will look at other incentives. Additionally, Davis plans to reintroduce his data breach bill, which passed the House last year but died in the Senate. “We will work with the majority staff to take FISMA to the next level,” he said. “We will refine the legislation and try to get it through again.” Davis said he has not had any conversations with Rep. Henry Waxman’s (D-Calif.) staff about the bill but expects to soon. Evans said the administration supported Davis’ bill last year, but he hasn’t vetted the new bill with OMB yet. “The trend is a good one,” Davis said. “We see progress across the board so now agencies have to fine-tune what they are doing and keep constant vigilance.” Evans said the improvement is an indication of agencies having a good security foundation. “The next goal is to get agencies over the hump and make security second nature,” she said. “They must think about the risk certain activities put on the network and department. Management and staff must evaluate risk every day.”
X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.