Inside a federal agency security program: GSA's IT security plan and its FISMA evaluation

This page draws on two primary documents. The first is the U.S. General Services Administration's FY23 IT Security Program Management Implementation Plan, Revision 10, dated January 30, 2023. The second is the independent FISMA evaluation of GSA for fiscal year 2020, dated November 18, 2020. The two documents cover different fiscal years. Together they show how a CISO's office writes down its program and how an outside evaluator tests one.

What the plan is and who approves it

The plan opens with the CISO's mandate. It states that the GSA CISO is responsible for running the agency's security program.

The document describes itself as a calendar for one fiscal year. It lists the main security activities and their due dates.

The plan says its stated purpose is to win management agreement with the milestones and with how progress will be measured.

The concurrence page lists six Authorizing Officials. They include David Shive, the GSA Chief Information Officer, along with officials for Acquisition IT Services, Technology Transformation Services, Public Building IT Services, Corporate IT Services and the Office of Governmentwide Policy. The approval page carries the name of Bo Berlas, GSA Chief Information Security Officer.

The version history shows yearly updates since December 5, 2008. Revision 10 added a named responsibility for each activity. It also added static code analysis to the monthly checklist and a High Value Asset data call to the annual activities.

How the plan organizes risk and reporting

The plan places system work inside a three-tier model: enterprise, mission or business process, and information system. The operational tier is the base.

According to the plan, system risks are passed up to Authorizing Officials at Level 2. Enterprise risks are handled at Level 1 through the GSA Enterprise Risk and Strategic Initiatives Board. The guide also sets up regular reporting from the CISO to the officials who accept risk.

The plan's requirements depend on whether a system counts as Federal or Contractor. A Contractor System is defined as one run entirely by a contractor outside GSA facilities.

The working cadence: on demand, monthly, quarterly

On demand. Some activities happen only when something triggers them. Examples include CISA directives, incident reporting, approval of new user accounts, audit log reviews and change impact analysis.

The vulnerability timelines are set out in detail. For items on CISA's Known Exploited Vulnerabilities (KEV) catalog with a CVE date after FY21, the deadline is 14 days.

GSA's standard timelines are 30 days for critical and high findings, 90 days for moderate findings, and 120 days for low findings on internet-accessible systems.

The plan says checklist dates do not set how often scans are reviewed. The checklist only confirms that the reviews took place.

Monthly. Federal systems have a monthly ISSO checklist, due on the 25th of each month and approved by the ISSM. It covers scan reviews, configuration compliance, impact analyses and system inventories.

The monthly list also includes an account check against the Separations Report, due within 30 days of receiving the report.

Quarterly. For FY23, FISMA quarterly metric reports are due January 13, April 7, July 7 and October 6, 2023.

The quarterly cycle also covers updates to POA&Ms and Acceptance of Risk letters, and checklists for contractor systems. Systems that have an Ongoing ATO also have program management reviews twice a year, on March 31 and September 29, 2023.

Annual work and the FY23 schedule shift

The annual federal checklist covers a long list of reviews:

• system security and privacy plans
• incident response plans and tests
• contingency plans and tests
• user recertification
• penetration test results
• interconnection agreements
• privacy assessments

The plan states that FY23 is a transition year. Several annual deadlines were moved earlier to fit the Inspector General's audit calendar.

The plan expects some teams to struggle with the earlier date and sets a limit on relief.

Vendors whose contracts already set annual delivery dates may keep those dates for FY23.

How the independent FISMA evaluation is built

The Inspector General's cover memo, dated December 4, 2020, states the legal basis for the evaluation.

The report names the firm that carried it out.

The OIG says it monitored KPMG's work but did not issue its own opinion on GSA's controls. The memo is clear on who is responsible for the conclusions.

The review period ran from October 1, 2019, through September 30, 2020. The report describes its sample of controls.

Scoring follows the DHS FY 2020 reporting metrics. These map the five NIST Cybersecurity Framework functions to eight domains.

The full list of eight domains also includes data protection and privacy, security training, continuous monitoring, incident response and contingency planning. The report explains the threshold for an "effective" rating.

What the FY2020 evaluation found

The overall rating rested on how most metric questions were scored.

The report also gives a rating for each function.

All of the deficiencies fell under the Protect function, in configuration management and in identity and access management.

The findings were:

• Unsupported software: a database version that had lost vendor support.
• Unauthorized changes: application changes without prior approval.
• Missing documentation: no record of baseline configuration scan reviews, which GSA attributed to ISSO turnover.
• Self-reauthorization: privileged users reauthorizing their own accounts.
• Audit alerts: inconsistent records of audit alert reviews.
• Unapproved accounts: user accounts created without formal approval.
• Late removal: accounts of separated staff not removed on time. The report notes those accounts were later removed.

On earlier years, the report says KPMG reviewed findings from FY2016 through FY2019.

In a written response, the GSA CIO agreed with the findings and recommendations.

Where the two documents meet

The two documents use many of the same controls:

• The plan's monthly Separations Report check matches the evaluation's finding on accounts that were not removed on time.
• The plan's requirement for evidence-backed checklists in Archer GRC matches the evaluation's recommendations to record who performed a review, what they did, and when.
• The plan's annual user recertification matches the finding that privileged accounts were being self-reauthorized.

The plan also moves its annual deadlines earlier so that they line up with the start of the Inspector General's yearly FISMA audit.