Which is also true in government contracting. What's odd is that security requirements are mandated by law, FISMA, so the government is supposed to require tha

Which is also true in government contracting. What's odd is that security requirements are mandated by law, FISMA, so the government is supposed to require that systems meet the FISMA requirements. You shouldn't be able to get an ATO without it, unless the management of that agency "accepts the risks" (SES levels only, gS personnel can't do this) and waives the vulnerabilities. So if I had to guess, if they didn't protect the data then it's likely those controls were notin place everyone knew they were not and the agency heads said it was ok. All fed systems get tested, and the system certifier is supposed to be an impartial reporter of the facts (these are the vulns, missing controls, risks, etc. and they are almost always impartial). They report those to the DAA along with a recommendation to approve or not approve the system to operate. Given how important this system was, I highly doubt anyone would not have issued the ATO no matter what vulns it had. And that's not to pick on this system, sadly slap dash rush ATOs happen far too often in the USG. If you spend a ton of time and money on a system, execs in the USG have their careers on the line to show that wasn't wasted and since they don't understand security it all seems like science fiction to them. They almost always ATO the system. And why not, no USG exec has ever been fired for having a poorly protected system broken into.