Cybersecurity: OMB Should Improve Information Security Performance Metrics

To protect federal information and systems, FISMA requires federal agencies to develop, document, and implement information security programs. The Federal Information Security
Modernization Act (FISMA) includes a provision for the Government Accountability Office (GAO) to periodically report on agencies’ implementation of the act.

The GAO’s objectives in this report were to identify the reported effectiveness of agencies’ efforts to implement FISMA, the key practices used by agencies to meet FISMA requirements, and how FISMA metrics could be changed to better measure the effectiveness of federal agency information security programs.