Since 2016, the GSA has worked on publishing a governmentwide inventory detailing the use of almost 400,000 federal assets, which include 130,000 buildings, as well as their location. However, over 67 percent of the street addresses in the database were incomplete or incorrectly formatted, according to the report.

In the Feb. 6 report, the GAO recommended GSA coordinate with agencies to ensure information is accurate and if it’s needed to withhold any security-sensitive information from public release; allow agencies to provide summary data about their activity in secure installations; review anomalies in data to better target incorrect information; instruct agencies to apply a risk-based approach to identify sensitive information; and publicly display available real property data sources.

If these recommendations are not carried out, GSA could inaccurately inform the public and researchers about the activities carried out in federal buildings and if they are accessible to the public, undermining the database’s utility and benefits.

“The lack of publicly available data and data quality issues have posed problems for people wanting to use the federal real property for various purposes, such as leasing or purchasing space that the federal government no longer needs,” the report read.

A GAO report released in December found that, while the agency meets its costs and schedule goals, it does not report the projects’ final costs or if these were revised.

In a letter by the General Services Administration, GSA disagreed with the recommendation to let agencies determine what sensitive information should be withheld from public release because it would make comparisons between agencies more difficult, according to the letter.

The agency agreed with all other five recommendations and said it would take necessary actions to address each of them but didn’t elaborate on what these would be.

Ross will be transitioning to the systems security engineering (SSE) project to “focus on DevSecOps and building security into the [system development life cycle],” he wrote. The project looks to influence and affect trustworthiness and cyber resilience of the services used in day-to-day activities, he said.

“The long-term objective is to work with government, industry and academia to build a world-class set of best practices in this area that can be voluntarily embraced by the public and private sector,” Ross said.

Victoria Pillitteri, who has worked alongside Ross for four years as a senior researcher, will take over FISMA. However, Ross will continue to work on FISMA publications while expanding the SSE project, Pillitteri said.

Ross said his “finale” will be the Security and Privacy Controls for Information Systems and Organizations Fifth Revision (SP 800-53 Rev. 5), which provides the government with new security controls to follow based on threat intelligence.

In August, Ross said many NIST publications with cybersecurity controls depend on the release of SP 800-53, which has been delayed by an Office of Management and Budget review. SP 800-171B, which offers federal agencies security requirements to protect the confidentiality of controlled unclassified information, is waiting final release as it contains provisions linked to provisions in SP 800-53 Rev. 5.

Ross will lead the FISMA project until SP 800-53 is published in its final form. He has been leading the SSE project he is transitioning to since 2012.

“This transition will allow a full-time focus on the SSE work and to explore new and emerging approaches in methodologies such as DevSecOps,” said Ross.

In 2012, Congress directed the FAA establish a program to integrate drones into the national airspace system, and it has since established seven nationwide test sites for that purpose. These sites have facilitated around 15,000 flight tests since 2015, according to the report, and the program is authorized until 2023, when the FAA will submit a report to Congress with information on the key capabilities needed to fully integrate drones.

In the Jan. 9 report, however, the GAO recommended the FAA develop a data analysis plan for gathered site data and publicly share more information as how the program contributes to the integration of drones, also known as unmanned aircraft systems, remains unclear. If these recommendations are not carried out, the FAA could fail to inform future drone integration efforts, the report suggested.

“All test site representatives and most users GAO interviewed […] said that more information on test sites’ research would be helpful for UAS stakeholders’ research efforts,” the report read. “By sharing more information publicly, FAA could demonstrate to such stakeholders how the agency is fostering and using research to inform and advance integration.”

The report came after another GAO report released in December on the FAA failure to keep track of all costs related to drone operations, resulting in incomplete information when identifying future costs.

In a letter by the Department of Transportation, the FAA said the findings “do not accurately characterize the FAA’s actions regarding the management of the Test Site Program.” The FAA only partially agreed with the recommendation to develop a plan to analyze collected data because, according to the letter, the agency cannot share data from private entities using the test sites. The GAO, in return, agreed to change some of the language to the first recommendation to address the issues the FAA raised.

The FAA agreed with the second recommendation to publicly share more information on how the program informs drone integration.

The FAA has 180 days from the report’s release to provide a response to each recommendation and demand any changes they deem necessary.