GAO urges improvements to FISMA

Clarifying agencies' information security obligations, requiring agency executives to ensure that their information security programs are effective, and bolstering oversight from the Office of Management and Budget could improve Federal Information Security Management Act programs, according to government auditors.

The recommendations from the Government Accountability Office on how to strengthen FISMA come as senators consider legislation to reform the law. Sen. Thomas Carper (D-Del.) introduced legislation in April designed to improve FISMA, which critics say relies too much on paper compliance reports and doesn’t fully fix security vulnerabilities.

Meanwhile, Gregory Wilshusen, director of information security issues at GAO, told the House Oversight and Government Reform Government Committee's Management, Organization and Procurement Subcommittee in May that many agencies have not fully or effectively implemented key elements of agencywide information security programs, as required by FISMA.

Wilshusen said GAO’s audits and reviews by agencies' inspectors general found significant deficiencies in information security controls that put agency operations and assets at risk. As a follow-up to that May testimony, the subcommittee’s leaders asked Wilshusen for recommendations to improve FISMA.

In a letter to the leaders dated June 30, Wilshusen said GAO recommended:

• Clarifying requirements for how agencies test and evaluate security controls.
• Requiring that agency executives include in their annual reports to Congress a statement testifying to the overall adequacy and effectiveness of their information security.
• Bolstering independent annual evaluations by requiring them to be performed in accordance with accepted government auditing standards.
• Expanding the data that OMB includes in its annual reports on agency compliance.
• Improving OMB's oversight of agency information security programs to increase accountability.