Why We Performed This Audit
The Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies, including the United States General Services Administration (GSA), to have an annual independent evaluation of their information security program and practices to determine the effectiveness of such program and practices. GSA contracted KPMG LLP (“KPMG” or “we”) to conduct this audit, and the GSA Office of Inspector General monitored KPMG’s work to ensure it met professional standards and contractual requirements.
We conducted a performance audit of GSA’s information security program in accordance with Generally Accepted Government Auditing Standards (GAGAS) and with the Office of Management and Budget’s (OMB’s) most recent FISMA reporting guidance to determine the effectiveness of GSA’s information security program and practices for its information systems for the period of October 1, 2025, through May 31, 2026. In addition to GAGAS, we conducted this performance audit in accordance with Consulting Services Standards established by the American Institute of Certified Public Accountants.
What We Found
Our testing for Fiscal Year (FY) 2026 included procedures at the entity and system levels for five GSA-owned information systems and five contractor-owned information systems. As directed by OMB and the Council of the Inspectors General on Integrity and Efficiency (CIGIE), the FY 2026 Inspector General (IG) FISMA Reporting Metrics (FY 2026 IG FISMA Reporting Metrics) served as the basis for our test procedures.
To support the overall performance audit objective, we also performed external penetration testing over a selected GSA-owned information system in order to identify potential system flaws, misconfigurations, or vulnerabilities that could increase the risk of unauthorized access or elevation of privileges to GSA systems and data. This technical security testing was completed as of July 8, 2026.
Additionally, we followed up on the status of three prior years’ findings. Based on our testing, we determined that GSA management implemented corrective actions to remediate two of the three prior years’ findings, and that these findings were closed (see Appendix I). However, we determined that one prior year finding remained open, and we also reported one new finding (see Section IV) in the Protect cybersecurity function within the following area:
Identity and Access Management
- Least Privilege and Separation of Duties –Lack of Access Review for Database Administrators for one GSA-owned information system.
The nature of this finding impacted our assessment of one of the associated FY 2026 IG FISMA Reporting Metrics within the Protect function, which was then factored into the calculated average rating of the function.
As a result of our procedures and based on the maturity levels calculated in CyberScope, we assessed GSA’s information security program as “Effective” according to OMB guidance. We made this determination based on the calculated averages of the FY 2026 IG FISMA Reporting Metrics being assessed as “Managed and Measurable” or “Optimized.” Specifically, the calculated averages of metrics in the Govern, Identify, Protect, Respond, and Recover cybersecurity functions were assessed as “Managed and Measurable,” while the Detect cybersecurity function was assessed as “Optimized.”
What We Recommend
We made one recommendation related to the new finding that should strengthen GSA’s information security program if effectively addressed by management. GSA management should also consider whether this recommendation applies to other information systems maintained in the organization’s FISMA system inventory and implement remedial action as needed.
We recommend that GSA management:
- Design and implement a process to formally review and reauthorize database administrator access for one GSA-owned information system at the defined frequency in accordance with GSA policy.
GSA management agreed with our finding and recommendation. The GSA Chief Information Officer’s response is included in Section VI.
