A0302-WEB VERSION Report on the Audit of Bds Info Security–

Board of Governors of the Federal Reserve System AUDIT OF THE BOARD’S INFORMATION SECURITY PROGRAM OFFICE OF INSPECTOR GENERAL (A0302) September 2003 September 29, 2003 The Honorable Mark W. Olson Chairman, Committee on Board Affairs Board of Governors of the Federal Reserve System Washington, DC 20551 Dear Governor Olson: We are pleased to present our Report on the Audit of the Board’s Information Security Program (A0302). We performed this audit pursuant to requirements in the Federal Information Security Management Act (FISMA). FISMA permanently reauthorized the framework laid out in the Government Information Security Reform Act (GISRA) which expired in November 2002. FISMA requires each agency Inspector General to conduct an annual independent evaluation of the agency’s information security program and practices. This was the third year that such evaluations were required; our first two evaluations were conducted pursuant to an identical requirement in GISRA. Our specific audit objectives, based on the legislation’s requirements, were to evaluate the effectiveness of security controls and techniques for selected information systems and to evaluate compliance by the Board of Governors of the Federal Reserve System (Board) with FISMA and related information security policies, procedures, standards, and guidelines. ...