Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
On an annual basis, OMB provides guidance with reporting categories and questions for
meeting the current year’s reporting requirements. 6 OMB uses this data to assist in its oversight
responsibilities and to prepare its annual report to Congress on agency compliance with FISMA.
Results of Review
Overall, we found that the Department had implemented an information security program,
but we identified weaknesses that significantly impact the information security program
controls. If these control weaknesses are exploited, the Department could be exposed to
additional security breaches. Collectively, these control weaknesses represent a significant
deficiency, as defined by the Office of Management and Budget M-11-33, to enterprise-wide
security including the Department’s financial system. The weakened security controls could
adversely affect the confidentiality, integrity, and availability of information and information
systems. A further compounding factor is that the Department had not taken corrective action to
remediate all of the control weaknesses identified in the FY2010 FISMA report. To improve the
information security program and to bring the program into compliance with FISMA, OMB, and
NIST requirements, the Department needs to address the following control weaknesses:
A. Risk Management Framework Needs Improvement
The Department needs to improve its risk management program for information security
at both the organization and the system levels. We found that the Department had not taken
adequate remedial actions to resolve control weaknesses reported in the FY 2010 OIG FISMA
report and that the Department continues to experience control deficiencies at both the
organizational and information systems levels of the Risk Management Framework (RMF). The
RMF is important because NIST SP 800-37 7 requires an organizational perspective with the
development of a comprehensive governance structure and organization-wide risk management
strategy, instead of sole reliance on security authorizations at the system level.
At the organizational level, the Department had not implemented an effective risk
management strategy addressing how it intends to assess, respond to, and monitor information
security risk as required by NIST 800-39. 8 As of June 30, 2011, the ISSC, 9 a key component of
the Department’s cyber security governance structure, had not met during FY 2011. The
committee chose to meet only during emergency events and not regularly, as specified in its
charter. Key members of the ISSC consist of the Chief Information Security Officer, the Senior
Coordinator for Security Infrastructure; Co-Executive Secretaries from the Office Information
Resource Management/Information Assurance/Policy Liaison and Reporting (IRM/IA/PLR) and
6 OMB Memorandum M-11-33, FY 2011 Reporting Instructions for the Federal Information Security Management
Act and Agency Privacy Management, dated Sept.14, 2011.
7 NIST SP 800-37, rev. 1, Guide for Applying the Risk Management Framework to Federal Information Systems,
Feb. 2010.
8 NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View,
March 2011.
9 According to the ISSC charter, members will meet on a monthly basis; more or less frequent meetings may be
scheduled at the request of any member, given a majority agreement of the ISSC. Among its responsibilities, the
ISSC shall: (a) Develop priorities and determine availability of resources for security of Department information
systems; (b) coordinate strategic direction of the Department’s information security efforts; and (c) support
Department funding and budget mechanisms as they relate to information security.
7
UNCLASSIFIED