United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 2006-10-20 monographic deposited born digital 28 p. GA 1.13:GAO-07-65 https://www.govinfo.gov/app/details/GAOREPORTS-GAO-07-65 P0b002ee180387f4c f:d0765 DGPO 2010-08-12 2011-03-24 GAOREPORTS-GAO-07-65 machine generated eng fdlp REPORT GAOREPORTS-GAO-07-65 GAO-07-65 Documentation Government information Information management Information security Information technology Internal controls Policy evaluation Security assessments Systems evaluation Systems testing Other Written Product A62544 Agencies rely extensively on computerized information systems and electronic data to carry out their missions. To ensure the security of the information and information systems that support critical operations and infrastructure, federal law and policy require agencies to periodically test and evaluate the effectiveness of their information security controls at least annually. GAO was asked to evaluate the extent to which agencies have adequately designed and effectively implemented policies for testing and evaluating their information security controls. GAO surveyed 24 major federal agencies and analyzed their policies to determine whether the policies address important elements for periodic testing. GAO also examined testing documentation at 6 agencies to assess the quality and effectiveness of testing on 30 systems. https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-07-65/html/GAOREPORTS-GAO-07-65.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-07-65/pdf/GAOREPORTS-GAO-07-65.pdf GAO-07-65 https://www.govinfo.gov/app/details/GAOREPORTS-GAO-07-65 Other Written Product GAO-07-65; Information Security: Agencies Need to Develop and Implement Adequate Policies for Periodic Testing; Documentation Government information Information management Information security Information technology Internal controls Policy evaluation Security assessments Systems evaluation Systems testing Public Law 107-347