Evaluation of FTC's Information Security Program and Practices for Fiscal Year 2012

The Federal Information Security Management Act of 2002 (FISMA) requires federal agencies to develop, document, and implement an agency-wide information security program. FISMA also requires each OIG to conduct an annual independent evaluation of its agency's information security program and practices. The FTC OIG contracted with Allied Technology Group, Inc., to conduct an evaluation to assess (1) the effectiveness of the FTC's information assurance and privacy programs and (2) agency compliance with Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) guidance. To improve FTC security and privacy programs and bring them current with OMB and NIST guidance, the OIG recommended improvements in the areas of risk management, capital planning, and the information security continuous monitoring program.