In May 2006, the Department of Veterans Affairs (VA) announced that computer equipment containing personal information on approximately 26.5 million veterans and active duty military personnel had been stolen. Given the importance of information technology (IT) to VA's mission, effective information security controls are critical to maintaining public and veteran confidence in its ability to protect sensitive information. GAO was asked to evaluate (1) whether VA has effectively addressed GAO and VA Office of Inspector General (IG) information security recommendations and (2) actions VA has taken since May 2006 to strengthen its information security practices and secure personal information. To do this, GAO examined security policies and action plans, interviewed pertinent department officials, and conducted testing of encryption software at select VA facilities.
Weaknesses in info. security (IS) are a widespread problem that can have serious consequences -- such as intrusions by malicious users, compromised networks, and the theft of intellectual property and personally identifiable info. -- and has identified IS as a governmentwide high-risk issue since 1997. Concerned by reports of significant vulnerabilities in fed. computer systems, Congress passed the Fed. IS Mgmt. Act of 2002 (FISMA), which authorized and strengthened IS program, evaluation, and reporting requirements for fed. agencies. This report evaluates: (1) the adequacy and effectiveness of agencies' IS policies and practices; and (2) fed. agencies' implementation of FISMA requirements. Includes recommendations. Illustrations.
The fed. gov¿t. is the world's largest and most complex entity, with about $3 trillion in outlays in FY 2008. Reports on high-risk areas bring focus to areas needing attention due to their greater vulnerabilities to fraud, waste, abuse, and mismanagement. These reports also identify areas needing transformation to address major economy, efficiency, or effectiveness challenges. This 2009 update presents the status of high-risk areas listed in 2007 and identifies new high-risk areas. Solutions to high-risk problems offer the potential to save billions of dollars, dramatically improve service to the public, strengthen confidence and trust in the performance and accountability of the U.S. gov¿t., and ensure the ability of gov¿t. to deliver on its promises. Illus.