Information Security: Status of Federal Public Key Infrastructure Activities at Major Federal Departments and Agencies

• NCJ Number: 203839
• Date Published: December 2003
• Length: 58 pages
• Corporate Author: US Government Accountability Office
• Sale Source: US Government Accountability Office
• Publication Format: Document (Online)
• Publication Type: Report (Study/Research)
• Language: English
• Country: United States of America
• Note: Report to the U.S. House Committee on Government Reform and the Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census; downloaded January 16, 2004.

Annotation

This study assessed the status of Federal public-key-infrastructure (PKI) activities, which are intended to provide computer hardware, software, policies, and personnel that can provide effective security in internal online applications.

Abstract

A congressional committee requested that the General Accounting Office (GAO) determine the status of Federal PKI activities, including the initiatives planned or in process at 24 major Federal departments and agencies, as well as the status and planned activities of the Federal Bridge Certification Authority (FBCA) and Access Certificates for Electronic Services (ACES) programs. The GAO was also asked to identify challenges encountered by the 24 agencies in their efforts to implement PKI initiatives since a GAO 2001 report on the status of PKI. A total of 20 of the 24 agencies reported that they are engaged in 89 PKI initiatives, which are at various stages of development. Collectively they involve a significant investment that is estimated at about $1 billion. In addition, the FBCA and ACES programs continue to promote the adoption and implementation of PKI; these programs, however, have had mixed progress and results. The level of participation in the FBCA, which provides a means to link independent agency PKI's into a broader network, has not changed since 2001. Similarly, the ACES program, which offers agencies various PKI services through a General Services Administration contract, has had lower participation from Federal agencies than expected. PKI implementation continues to pose major challenges for agencies; many of these are similar to those identified in the 2001 GAO report. The challenges profiled pertain to policy and guidance, funding, interoperability, and training and administration.