We conducted an independent evaluation of the Department of Homeland Security (DHS) information security program and practices to comply with the requirements of the Federal Information Security Management Act. In evaluating DHS’ progress in implementing its agency-wide information security program, we specifically assessed the Department’s plans of action and milestones, security authorization processes, and continuous monitoring programs. We performed fieldwork at both the program and component levels.