Report by KPMG LLP
Audit of the FDIC’s Security Certification and Accreditation Program

Corporation Comments and OIG Evaluation
Corporation Comments
Management Response to Recommendation

Audit of the FDIC’s Security Certification
and Accreditation Program

Introduction

• OIG contracted with KPMG LLP (KPMG) to audit and report on the FDIC’s security certification and accreditation (C&A) program.

• KPMG conducted its work from April through November 2005 in accordance with generally accepted government auditing standards. KPMG performed certain follow-up procedures subsequent to field work to consider recent improvements in the FDIC’s C&A program.

Introduction (Cont.)

• Certification involves the evaluation of an information system’s management, operational, and technical security controls.

• Accreditation involves a senior agency official’s authorization of an information system to operate.

• By accrediting an information system, the senior agency official accepts the risks associated with the system’s operation.

Introduction (Cont.)

• Agencies are required by Office of Management and Budget (OMB) policy to certify and accredit their information systems consistent with federal standards and guidelines issued by the National Institute of Standards and Technology (NIST).

• In addition, federal Inspectors General are required by OMB policy to assess and report on agency C&A programs as part of their annual independent security evaluations mandated by the Federal Information Security Management Act (FISMA).

• The results of this audit support the OIG in fulfilling its evaluation and reporting responsibilities under FISMA.

Objective, Scope, and Methodology

• The objective was to determine whether the FDIC’s C&A policies, procedures, and practices were satisfactory and consistent with federal standards and guidelines.

• The audit focused on the application of the FDIC’s C&A program policies, procedures, and guidelines to major applications and general support systems.

• Key criteria included OMB policy and NIST standards and special publications (SP), as identified in Attachment III.

Objective, Scope, and Methodology (Cont.)

NIST SP 800-37 divides the C&A process into 4 phases. The audit results are structured around these 4 phases.

	C&A Phase		Description
	Initiation		Review and agree upon security categorization, risk assessment, and security planning documentation.
	↓
	Certification		Determine security control effectiveness, address vulnerabilities in plan of action and milestone, and provide certification agent’s recommendations.
	↓
	Accreditation		Decide on authorizing a system for production by determining final risks to agency operations, assets, or individuals.
	↓
	Continuous Monitoring*		Monitor control of system placed in production and track changes that may impact system security.

Objective, Scope, and Methodology (Cont.)

• Key FDIC C&A policies, procedures, and guidelines reviewed:
  —  Circular 1310.3, Information Technology Security Risk
        Management Program
  —  Circular 1360.8, Information Security Categorization
  —  Division of Information Technology (DIT) Policy and
        Guidelines on Certification and Accreditation (C&A)
  —  DIT’s Risk Management Methodology
  

• C&A packages for three major applications selected for
  detailed review:
  —  New Financial Environment (NFE) Phase I
  —  Legal Integrated Management System (LIMS)
  —  Asset Servicing Technology Enhancement Project—Metavante
  

Objective, Scope, and Methodology (Cont.)

• The FDIC OIG surveyed seven federal Inspectors General to obtain certain information regarding their agencies’ C&A programs.

• The audit results build upon information we provided to DIT throughout the audit:
  —  April 2005 CIO briefing on the NFE Phase I C&A package
  —  July 2005 DIT management briefing on the FDIC’s C&A
        policies and procedures
  —  September 2005 OIG FISMA report suggested improvements,
        such as (a) ensuring plans of action and milestones (POA&Ms)
        reflect all relevant security weaknesses (b) integrating processes
        for identifying mission-critical applications with processes for
        determining application availability for Federal Information
        Processing Standards (FIPS) Publication (PUB) 199 purposes and
        (c) re-evaluating the 180-day duration for interim system
        authorizations.
  

Background

• Pursuant to its statutory responsibilities under FISMA, NIST continues to develop risk-based security standards and guidelines for securing federal information systems.

• NIST standards and guidelines are introducing significant changes in how federal agencies, including the FDIC, protect their information and systems.

• The President and OMB continue to place a high priority on fully certifying and accrediting federal information systems.

• The FDIC has focused its C&A efforts to date on major applications and general support systems. The FDIC plans to place priority attention on its sensitive non-major applications in 2006 to ensure that potential security risks associated with these systems are addressed.

Overall Results

• The FDIC’s C&A policies, procedures, and practices were satisfactory and consistent with federal standards and guidelines.

• The FDIC continued to build its C&A program throughout 2005 in response to evolving NIST guidance, and additional improvements were underway at the close of our field work.

• The audit identified opportunities for the FDIC to further strengthen its C&A program policies, procedures, and guidelines. Generally, these opportunities existed because the FDIC’s C&A program has been evolving in response to emerging NIST requirements and the Corporation’s security management needs.

• Addressing the issues in this report will provide FDIC management greater assurance that system security risks are effectively managed and that C&A practices are consistently applied throughout the Corporation.

FDIC C&A Program Accomplishments

• Established and implemented policies, procedures, and/or guidelines to:
  —  Classify information systems and data
  —  Assess security risks
  —  Plan for security
  —  Test and evaluate system security controls
  —  Develop POA&Ms
  —  Ensure that system owners are actively engaged in C&A
        program activities
  —  Standardize accreditation decisions
  —  Monitor system security controls
  

FDIC C&A Program Accomplishments (Cont.)

• Implemented a risk-based approach to certify and accredit the information systems that pose the greatest risk to the FDIC (i.e., major applications and general support systems).

• Achieved process efficiencies by identifying and testing “common” security controls that cross system boundaries, such as personnel and physical security controls.

Initiation Phase - Areas That Can Be Strengthened

• Sensitivity Assessment Questionnaire (SAQ) guidance should be enhanced to:
  —  Describe how the initial FIPS PUB 199 categorization (which
        is based on an analysis of system data sensitivity and categorizes
        the data into high, moderate, and low impact) can be modified
        by the responses to SAQ questions in determining an application’s
        final FIPS PUB 199 categorization.
  —  Address requirements for documenting management’s rationale
        for maintaining or changing initial FIPS PUB 199 categorizations.
  

Initiation Phase - Areas That Can Be Strengthened (Cont.)

• Application security plans include a description of the IT environment in which the application operates. However, guidance for preparing application security plans should be enhanced to require that security plans describe how (a) common security controls and (b) system components critical to the security of the application (such as database management and server operating systems) are considered in the application’s C&A.
  —  Provides greater clarification of system boundaries for C&A
        purposes and greater assurance that all relevant risks are
        considered when accrediting applications.
  —  Promotes efficiency because many relevant system components
        are covered in other security plans and common controls
        are covered in a separate Security Test and Evaluation (ST&E).
  

Initiation Phase - Areas That Can Be Strengthened (Cont.)

• Procedures for reducing or eliminating vulnerabilities identified from risk assessments should be enhanced to better describe when the cost-benefit of alternative control solutions should be considered. The consideration of cost-benefits could be as simple as a memorandum to the file and may accompany an implementation plan.

• Procedures should be enhanced to establish an independent milestone review before proceeding to the Certification Phase. Such a “check point” would provide additional assurance that system security categorizations, risk assessments, and security plans are current, accurate, and complete.
  —  The Certification Agent plays a key role.
  —  The level of rigor should be consistent with the FIPS
        PUB 199 impact.
  

Certification Phase - Areas That Can Be Strengthened

• Procedures for planning and conducting ST&E should:
  —  Define the nature and scope of ST&E test case validations,
        including requirements for ensuring independence in the process.
  —  Include requirements for gathering, reviewing, and reusing
        (where appropriate) previous assessments, audits, and evaluation
        results. Such assessments and audit work can also benefit
        Continuous Monitoring activities.
  

Certification Phase - Areas That Can Be Strengthened (Cont.)

• Procedures for preparing and managing POA&Ms should be enhanced to define the Certification Agent’s role in providing recommendations to system owners to correct security control deficiencies identified during ST&E.

• Procedures for accepting moderate or high risk associated with known security vulnerabilities should be enhanced to ensure that:
  —  Relevant federal standards and guidelines are considered in
        justiifying decisions to accept risk.
  —  A standard format for accepting risk is used, such as DIT’s
        Memorandum of Acceptance of Risk, when circumstances
        warrant (such as when the risk is high or moderate).
  

Certification Phase - Areas That Can Be Strengthened (Cont.)

• Procedures should be enhanced to establish an independent milestone review by the Certification Agent before proceeding to the Accreditation Phase. Such a review would provide additional assurance that:
  —  System owners fully describe corrective actions taken to close
        system-level weaknesses on POA&Ms.
  —  All security weaknesses are fully addressed in system-level
        POA&Ms and included in the final certification package.
  —  Justifications for accepting moderate or high risk are adequately
        documented, when circumstances warrant.
  

• Procedures should be enhanced to require that certification letters identify those security vulnerabilities that must be remediated in order to achieve full accreditation when recommending an Interim Authority to Operate (IATO).

Accreditation Phase - Areas That Can Be Strengthened

• IATO guidance should be enhanced to:
  —  Describe how terms and conditions (i.e., limitations on
        system operations) should be defined and documented.
  

• As referenced in the Initiation Phase, guidance should be enhanced to better describe how common security controls and system components critical to the security of an application are to be considered and reported in the accreditation letter.

Continuous Monitoring Phase - Areas That Can Be Strengthened

• C&A guidelines should be enhanced to:
  —  Describe how security controls will be selected and monitored
        following an IATO or full authorization to operate.
  —  Describe the use of POA&Ms in the status reporting component
        of Continuous Monitoring.
  

Conclusion and Recommendation

The FDIC has made significant strides in developing its C&A program in response to emerging NIST requirements. This report identifies opportunities for the FDIC to further strengthen its C&A policies, procedures, and guidelines.

KPMG recommends that the Chief Information Officer strengthen the FDIC’s C&A policies, procedures, and guidelines by considering and addressing, as appropriate, the issues described in this report.

Attachment I

Key Observations of IG Survey

We surveyed IGs of seven federal agencies that had a C&A program assessment rating of satisfactory or higher based on their 2004 FISMA evaluation. The results are as follows.

• Most OIGs reported that their agency had categorized all of their major applications and general support systems in accordance with FIPS PUB 199.

• Less than one half of the OIGs reported that their agency had identified “common” security controls. A lesser number of these same agencies had certified and accredited their common security controls.

• Most OIGs reported that their agency’s system-level POA&Ms included all relevant IT security weaknesses, including OIG- and GAO-identified weaknesses.

Attachment I

Key Observations of IG Survey (Cont.)

• Some IGs reported that their agencies used the Automated Security Self-Evaluation and Remediation Tracking tool to centrally manage the remediation of security weaknesses.

• Almost all IGs reported that their agencies had certified and accredited their general support systems before certifying and accrediting any overlaying applications. One OIG recommended that the agency identify risks associated with unaccredited general support systems in major application C&A packages.

• Almost all IGs reported that their agencies had developed IATO policies or procedures.

• Some IGs reported that their agencies’ C&A programs included a quality assurance component (a GAO- recommended practice).

Attachment II

Prior Audits, Performance Measures, and Fraud

• Relevant reports and correspondence include:
  —  September 2005 OIG report entitled, Independent Evaluation
        of the FDIC’s Information Security Program-2005
        (Report No. 05-040)
  —  September 2005 OIG report entitled, Responses to Security-
        Related Questions Raised in OMB ‘s Fiscal Year 2005 Reporting
        Instructions for FISMA and Agency Privacy Management
        (Report No. 05-034)
  —  OIG Memorandum entitled, FDIC ‘s Information Security
        Program, dated November 8, 2005
  

Attachment II

Prior Audits, Performance Measures, and Fraud (Cont.)

• KPMG did not evaluate the FDIC’s C&A program performance measures as part of the audit. Such procedures were performed as part of the OIG’s annual information security evaluation required by FISMA.

• KPMG did not develop specific audit procedures to detect fraud and illegal acts because they were not considered material to the audit objective. However, throughout the audit, KPMG was sensitive to the potential of fraud, waste, abuse, and mismanagement.

Attachment III

Laws, Regulations, Standards, and Guidelines

• Key statutes, regulations, standards, and guidelines:
  —  Federal Information Security Management Act of 2002
  —  OMB Circular No. A-130, Management of Federal
        Information Resources Appendix III, Security of Federal
        Automated Information Resources
  —  OMB Memorandum M-02-1, Guidance for Preparing and
        Submitting Security Plans of Action and Milestones
  —  NIST SP 800-37, Guide for the Security Certification and
        Accreditation of Federal Information Systems
  —  NIST FIPS PUB 199, Standards for Security Categorization
        of Federal Information and Information Systems
  —  NIST SP 800-60, Guide for Mapping Types of Information
        and Information Systems to Security Categories
  —  NIST SP 800-53, Recommended Security Controls for
        Federal Information Systems
  

Acronyms

Glossary

• Providing advice and other assistance to the head of the executive agency and other senior management personnel to ensure that agency information technology is acquired and information resources are managed in a manner that is consistent with laws, Executive Orders, directives, policies, regulations, and priorities established by the head of the agency.
• Developing, maintaining, and facilitating the implementation of a sound and integrated information technology architecture for the agency.
• Promoting the effective and efficient design and operations of all major information resources management processes for the agency, including improvements to work processes of the agency.

CORPORATION COMMENTS

DIT has begun assessing the observations made in the draft report. DIT will provide a matrix that documents DIT’s consideration of the observations.