Title page
Contents
Highlights 2
Letter 5
Background 9
DCSA and Background Investigation Services 10
Overview of NBIS and Legacy Systems 11
Cybersecurity Risk Management 12
GAO's Prior Work on the Cybersecurity of Background Investigations and Sensitive Personal Information 15
DCSA Has Not Fully Planned for the Cybersecurity of NBIS and Legacy Systems 16
DCSA Did Not Fully Address Required Tasks for Preparing the Selected Systems to Manage Cybersecurity Risks 16
DCSA Fully Categorized the Security Level of Selected Systems 19
DCSA Selected Controls for Each System but Did Not Follow Current Guidance 20
DCSA Did Not Fully Implement Privacy Controls for Selected Background Investigation Systems 22
DCSA's Policies and Procedures for Selected Privacy Controls Did Not Document Key Information or Have Evidence of Review 23
DCSA Did Not Ensure Users Had Current Training and Certifications 25
DCSA Has Not Fully Defined the Types of Events to be Logged 26
DCSA Did Not Develop an Assessment Plan or Conduct Risk Assessments for Selected Systems 27
Privacy Control Shortfalls Were Largely Allowed to Occur Due to the Lack of a Process to Ensure CIO Oversight 28
Conclusions 29
Recommendations for Executive Action 30
Agency Comments and Our Evaluation 32
Appendix I: Objectives, Scope, and Methodology 35
Appendix II: Comments from the Department of Defense 40
Appendix III: Contacts and Staff Acknowledgments 46
Table 1. Extent to Which DCSA Policies and Practices Addressed Required Tasks in the Prepare Step of DOD's Risk Management Framework at the Organization and System Levels 16
Table 2. DCSA-Assigned Impact Levels for the Six Selected Background Investigation Systems 20
Table 3. Control Areas and Privacy Controls for Selected Background Investigation Systems 22
Table 4. Selected NBIS and Legacy Background Investigation Systems 35
Table 5. Summary of Selected Privacy Controls for National Background Investigation Services and Legacy Background Investigation Systems 38
Figure 1. Overview of DOD's Cybersecurity Risk Management Framework Steps for IT Systems 14