Testimony of Bruce N. Crandlemire, Assistant Inspector General for Audit U.S. Agency for International

1. 372318 Office of Inspector General Testimony of Bruce N. Crandlemire, Assistant Inspector General for Audit U.S. Agency for International Development Submitted to the Committee on Government Reform U.S. House of Representatives No Computer System Left Behind: A Review of the Federal Government’s D+ Information Security Grade April 7, 2005 Mr. Chairman and other Committee members: Thank you for the opportunity to provide testimony on the U.S. Agency for International Development’s (USAID) compliance with the Federal Information Security Management Act of 2002 (FISMA). As you have requested, my testimony will focus on the state of information security at USAID and the methodology we used to perform our fiscal year 2004 FISMA audit. In addition, I will discuss the need for a standardized FISMA auditing framework and what additional guidance is needed for agencies to fully comply with FISMA. STATE OF INFORMATION SECURITY AT USAID USAID has made many positive strides over the last few years in addressing information security weaknesses. In particular, USAID has made several improvements in response to audits performed by my office and, in turn, substantially improved its computer security program. Although there have been improvements in information security, USAID still faces several important challenges to refine its information security environment. In 1997, the Office of Inspector General (OIG) identified information security as a material ...