United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 2008-03-12 monographic deposited born digital 35 p. GA 1.13:GAO-08-571T https://www.govinfo.gov/app/details/GAOREPORTS-GAO-08-571T P0b002ee18037dfef f:d08571t DGPO 2010-08-12 2011-03-23 GAOREPORTS-GAO-08-571T machine generated eng fdlp REPORT GAOREPORTS-GAO-08-571T GAO-08-571T Access control Computer systems Cyber security Data integrity Federal agencies Federal law Government information Government information dissemination Information disclosure Information infrastructure Information management Information security Information security management Information systems Information technology Internal controls Performance measures Policy evaluation Program evaluation Reporting requirements Risk assessment Risk management Systems evaluation Systems integrity Systems testing Program implementation GAO High Risk Series Testimony A81297 Information security is especially important for federal agencies, where the public's trust is essential and poor information security can have devastating consequences. Since 1997, GAO has identified information security as a governmentwide high-risk issue in each of our biennial reports to Congress. Concerned by reports of significant weaknesses in federal computer systems, Congress passed the Federal Information Security Management Act (FISMA) of 2002, which permanently authorized and strengthened information security program, evaluation, and annual reporting requirements for federal agencies. GAO was asked to testify on the current state of federal information security and compliance with FISMA. This testimony summarizes (1) the status of agency performance of information security control activities as reported by major agencies and their inspectors general (IG), (2) the effectiveness of information security at federal agencies, and (3) opportunities to improve federal information security. In preparing for this testimony, GAO analyzed agency, IG, Office of Management and Budget (OMB), and GAO reports on information security and reviewed OMB FISMA reporting instructions, information technology security guidance, and information on reported security incidents. https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-08-571T/html/GAOREPORTS-GAO-08-571T.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-08-571T/pdf/GAOREPORTS-GAO-08-571T.pdf GAO-08-571T https://www.govinfo.gov/app/details/GAOREPORTS-GAO-08-571T Testimony GAO-08-571T; Information Security: Progress Reported, but Weaknesses at Federal Agencies Persist; Access control Computer systems Cyber security Data integrity Federal agencies Federal law Government information Government information dissemination Information disclosure Information infrastructure Information management Information security Information security management Information systems Information technology Internal controls Performance measures Policy evaluation Program evaluation Reporting requirements Risk assessment Risk management Systems evaluation Systems integrity Systems testing Program implementation GAO High Risk Series Volume 116 Page 2899 116 Stat. 2899 Public Law 107-347