The Department of Homeland Security has not fully implemented a comprehensive information security program, according to the Governmental Accountability Office.
In a report released Monday, the GAO said key infosec practices and controls - including risk assessments, testing and evaluation of security controls, and remedial action plans - were either incomplete or missing in a review of selected DHS departmental components.
DHS has an "enterprisewide tool" for overseeing implemention of security controls but that tool has not been reliable, according to the report.
"Until DHS addresses weaknesses with using the tool and implements a comprehensive, departmentwide information security program, its ability to protect its information and information systems will be limited," GAO analysts said.
In a written response, DHS officials generally agreed with the report and outlined what the agency is doing to implement its infosec program.
In May, the GAO reported that DHS was lagging in its cybersecurity responsibilities, including development of national cyber threat and vulnerability assessments and recovery plans.
