NASA OIG: Review of NASA’s Management and Oversight of Its Information Technology Security Program
We found that NASA’s IT security program had not fully implemented key FISMA requirements needed to adequately secure Agency information systems and data. For example, we found that only 24 percent (7 of 29) of the systems we reviewed met FISMA requirements for annual security controls testing and only 52 percent (15 of 29) met FISMA requirements for annual contingency plan testing. In addition, only 40 percent (2 of 5) of the external systems we reviewed were certified and accredited. These deficiencies occurred because NASA did not have an independent verification and validation function for its IT security program. We also found that NASA’s Office of Chief Information Officer (OCIO) had not effectively managed corrective action plans used to prioritize the mitigation of IT security weaknesses. This occurred because OCIO did not have a formal policy for managing the plans and did not follow recognized best practices when it purchased an information system that it hoped would facilitate Agency-wide management of IT corrective action plans. However, after spending more than $3 million on the system since October 2005, implementation of the software failed. The Agency is currently expending funds to acquire a replacement system. Specifically, we found that the information system was significantly underutilized and therefore was not an effective tool for managing corrective action plans across NASA. For example, the system contained corrective actions plans for only 2 percent (7 of 289) of the 29 systems we sampled. In our judgment, the system was underutilized because OCIO did not fully document detailed system requirements prior to selecting the system and did not have users validate requirements via acceptance testing prior to implementing it. Because the information system contained minimal data and the manual process the Agency relied on was not consistently followed, OCIO’s management of corrective actions plans was ineffective and did not ensure that significant IT security weaknesses were corrected in a timely manner. Until NASA takes steps to fully meet FISMA requirements and to improve its system acquisition practices, NASA’s IT security program will not be fully effective in protecting critical Agency information systems. Moreover, until such improvements are made OCIO will not be in a position to effectively allocate resources to correct IT security weaknesses. Management
1 NPR 2810.1A, “Security of Information Technology,” Chapter7, defines moderate impact as “loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on NASA operations, organizational assets, or individuals.” High impact is defined as “loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on NASA operations, organizational assets, or individuals.” 2 NASA OIG. “Federal Information Security Management Act: Fiscal Year 2009 Report from the Office of Inspector General” (IG-10-001, November 10, 2009). 3 NASA OIG. “Review of the Information Technology Security of the Internet Protocol Operational Network (IONet)” (IG-10-013, May 13, 2010); and NASA OIG. “Audit of NASA’s Efforts to Continuously Monitor Critical Information Technology Security Controls” (IG-10-019, September 14, 2010).
