FAA Is Taking Steps to Properly Categorize High-Impact Information Systems but Security Risks Remain Until High Security Controls Are Implemented

What We Looked AtAs the Federal Aviation Administration’s (FAA) operational arm, Air Traffic Organization (ATO) is responsible for providing safe and efficient air navigation services in U.S. controlled airspace. ATO provides air navigation services in over 17 percent of the world’s airspace and includes large portions of international airspace over the Atlantic and Pacific Oceans and the Gulf of Mexico. Until recently, FAA ATO had never applied the high-impact security categorization rating to any of its information systems. While many of these systems provide safety-critical services and would have adverse high impact to FAA’s mission in the event of system failure, and on the safety and efficiency of the National Airspace System (NAS), FAA categorized all of them as low or moderate. Given the importance of ATO’s information systems to air traffic control security and traveler safety, we initiated this audit. Our audit objectives were to assess (1) FAA’s information system categorization process and (2) the security controls that FAA has selected for the systems it recently re-categorized as high impact. Our RecommendationsFAA concurred with all six of our recommendations to enhance FAA’s categorization process, and mitigate security risks until the Agency selects and implements high security controls for its re-categorized high-impact systems. THE DEPARTMENT HAS DETERMINED THAT THIS REPORT CONTAINS SENSITIVE SECUITY INFORMATION (SSI) that is controlled under 49 CFR parts 15 and 1520 to protect Sensitive Security Information exempt from public disclosure. For U.S. Government agencies, public disclosure is governed by 5 U.S.C. § 552 and 49 CFR parts 15 and 1520. SSI will be redacted from the report version posted on our website.