United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 2008-02-14 monographic deposited born digital 33 p. GA 1.13:GAO-08-496T https://www.govinfo.gov/app/details/GAOREPORTS-GAO-08-496T P0b002ee18039551a f:d08496t DGPO 2010-08-12 2011-03-24 GAOREPORTS-GAO-08-496T machine generated eng fdlp REPORT GAOREPORTS-GAO-08-496T GAO-08-496T Computer security Computer systems Controlled access Federal agencies Information security Information security management Information security regulations Internal controls Policy evaluation Program evaluation Program management Reporting requirements Risk assessment Risk management Systems integrity Program implementation GAO High Risk Series Testimony A80794 Information security is especially important for federal agencies, where the public's trust is essential and poor information security can have devastating consequences. Since 1997, GAO has identified information security as a governmentwide high-risk issue in each of its biennial reports to the Congress. Concerned by reports of significant weaknesses in federal computer systems, Congress passed the Federal Information Security Management Act (FISMA) of 2002, which permanently authorized and strengthened information security program, evaluation, and annual reporting requirements for federal agencies. GAO was asked to testify on the current state of federal information security and compliance with FISMA. This testimony summarizes (1) agency progress in performing key control activities, (2) the effectiveness of information security at federal agencies, and (3) opportunities to strengthen security. In preparing for this testimony, GAO reviewed prior audit reports; examined federal policies, guidance, and budgetary documentation; and analyzed agency and inspector general (IG) reports on information security. https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-08-496T/html/GAOREPORTS-GAO-08-496T.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-08-496T/pdf/GAOREPORTS-GAO-08-496T.pdf GAO-08-496T https://www.govinfo.gov/app/details/GAOREPORTS-GAO-08-496T Testimony GAO-08-496T; Information Security: Although Progress Reported, Federal Agencies Need to Resolve Significant Deficiencies; Computer security Computer systems Controlled access Federal agencies Information security Information security management Information security regulations Internal controls Policy evaluation Program evaluation Program management Reporting requirements Risk assessment Risk management Systems integrity Program implementation GAO High Risk Series Volume 116 Page 2899 116 Stat. 2899 Public Law 107-347