"Whats happening with the two most strategic and sensitive agencies? Is it incompetence? Is it cronyism?" said Rep. Diane Watson, D-Calif.
"I dont feel comfortable that my homeland is secure. What are you securing?"
Areas of greatest concern to policymakers include inconsistent incident reporting, inconsistent contingency plan testing, lack of specialized security training and lack of configuration management policies, Davis said.
Despite the governments overall poor rating, some agencies showed improvement.
Five agencies, including the Department of Labor, Environmental Protection Agency and Social Security Administration, received an A+.
The National Science Foundation earned an A, up from a C+, and the General Services Administration earned an A-, up from a C+.
Tom Hughes, chief information officer at SSA, said that his agencys success results from an agencywide approach to data security and accountability among the top executives.
Click here to read more about the governments claims of progress in its security efforts.
The larger agencies face more complicated security challenges because they are often composed of semi-autonomous bureaus with separate missions, funding and technologies, and vulnerabilities in one bureau can affect other parts of the department, said Gregory Wilshusen, director of Information Security Issues at the Government Accountability Office.
"Its going to require that agency top management and the management of the different bureaus be held accountable," Wilshusen said.
Industry observers widely agree that only greater accountability and commitment at the top will lead to improvement in the future.
"In the commercial world, people get fined or go to jail when they dont comply. The Feds dont seem to have the same motivation," said Chris Farrow, director for the Center for Policy and Compliance at Configuresoft, adding that many agencies are not lacking in funding or tools.
"Homeland Defense has the largest budget out there. They got an F last year, and this year they failed again."
Theres some concern that many of the agencies are focused on "studying for the test" rather than on long-term, sustainable security.
"The question is, what does a B really mean? Does it mean that someone just knows how to take the test now?" said Richard Tracy, CTO of Telos, which sells automated certification and accreditation tools.
"Its not just about checking the box."
In the realm of certification and accreditation of networking systems, some agencies have invested heavily in labor to improve their grades, said Tracy.
At any given agency there are hundreds of systems affected by FISMAs C&A requirements, Tracy said.
Detailed information about IT assets must be collected, evaluated for a variety of security requirements and assessed for risks, and automated tools could reduce costs by as much as 70 percent, he said.
"The next question will be how do we sustain this compliance? The answer will be automation," he said. "It has to be. Theres no other way around it."
Check out eWEEK.coms for the latest news, views and analysis of technologys impact on government and politics.
Government IT 
