Citation[]
Government Accountability Office, Cybersecurity: Continued Federal Efforts Are Needed to Protect Critical Systems and Information (GAO-09-835T) (June 25, 2009) (full-text).
Overview[]
Pursuant to its responsibilities under the Federal Information Security Management Act (FISMA), the NIST has developed standards specifying minimum security requirements for federal information and information systems; and provided corresponding guidance that details the controls necessary for securing those systems. It has also been working with both public and private sector entities to enhance information security requirements. The resulting guidance and tools provided by NIST serve as important resources for federal agencies that can be applied to information security programs.
As GAO testified in May 2009, opportunities exist to improve the metrics used to assess agency information security programs. According to the performance metrics established by the Office of Management and Budget (OMB), agencies reported increased compliance in implementing key information security control activities. However, GAO and agency inspectors general continue to report significant weaknesses in controls. This dichotomy exists in part because the OMB-defined metrics generally do not measure how well controls are implemented. As a result, reported metrics may provide an incomplete picture of an agency's information security program.