Washington, D.C. - U.S. Office of Personnel Management (OPM) Director Linda M. Springer announced OPM has received an "A+" score for compliance with provisions of the Federal Information Security Management Act (FISMA) for Federal fiscal year (FFY) 2005. FISMA, signed into law by President George W. Bush as part of the Electronic Government Act of 2002, is designed to ensure Federal agencies develop measures and policies to protect governmental information and assets from external threats.

Springer said the agency's A+ rating can be attributed to a series of measures taken within OPM over the last Federal fiscal year to improve information security. These include:

· Monthly information technology working group meetings to ensure agency-wide consistency in security practices and policies;

· Mandatory information technology security awareness training for all OPM staff;

· Improvement of OPM's certification and accreditation processes;

· Successful testing of all information security contingency plans and controls; and, 

· An increase in the percentage of employees with significant information technology responsibilities who have received specialized training - 67 percent in FFY 2004 to 96 percent in FFY 2005.

The FISMA report card is generated by the House Committee on Government Reform. Grades are primarily based on reports submitted by agencies to the Office of Management and Budget, and reflect the Committee's assessment of these reports, which focus on information security management and the extent to which agencies have implemented an effective security program.

The Committee also considers the annual independent evaluation of each agency's information security program by the Inspector General of each agency.

Springer noted OPM was one of only five Federal agencies out of 24 evaluated to receive an A+ score. OPM received a score of C- in FFY 2004.

"Now that we have achieved an A+ score on the FISMA report card, we fully expect and intend to maintain our momentum," Springer added. "We will continue to work diligently to make improvements to our information security practices when and where necessary."