United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 2007-08-31 monographic deposited born digital 47 p. GA 1.13:GAO-07-528 https://www.govinfo.gov/app/details/GAOREPORTS-GAO-07-528 P0b002ee18037e1f4 f:d07528 DGPO 2010-08-12 2011-03-24 GAOREPORTS-GAO-07-528 machine generated eng fdlp REPORT GAOREPORTS-GAO-07-528 GAO-07-528 Computer security Employee training Information security Information systems Internal controls Testing Reporting requirements Risk management Government agency oversight Program implementation Other Written Product A75567 The Federal Information Security Management Act of 2002 (FISMA) strengthened security requirements by, among other things, requiring federal agencies to establish programs to provide cost-effective security for information and information systems. In overseeing FISMA implementation, the Office of Management and Budget (OMB) has established supporting processes and reporting requirements. However, 4 years into implementation of the act, agencies have not yet fully implemented key provisions. In this context, GAO determined what challenges or obstacles inhibit the implementation of the information security provisions of FISMA at the Departments of Defense, Homeland Security, Justice, and State. To do this, GAO reviewed and analyzed department policies, procedures, and reports related to department information security programs and interviewed agency officials. https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-07-528/html/GAOREPORTS-GAO-07-528.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-07-528/pdf/GAOREPORTS-GAO-07-528.pdf GAO-07-528 https://www.govinfo.gov/app/details/GAOREPORTS-GAO-07-528 Other Written Product GAO-07-528; Information Security: Selected Departments Need to Address Challenges in Implementing Statutory Requirements; Computer security Employee training Information security Information systems Internal controls Testing Reporting requirements Risk management Government agency oversight Program implementation Public Law 107-347