under fisma, gao is responsible for assessing the security at federal agencies and compliance of the provisions of the act. that is the other side is federal law. another requirement for agencies to follow. and our report we do address how well federal agencies are meeting those requirements are based on the work that gao has performed, as well as the work that agency i.g.'s and agencies themselves have issued. host: 11 of the 24 agencies have significant deficiencies when it comes to protecting information on federal systems, you say. what did you mean by significant deficiencies? guest: that dealt with the result of the financial statement audits of federal agencies. as part of an agency's audit, the auditors are supposed to review their internal controls over financial resources and reporting. a key component of an agency's internal control are the controls of the financial systems. what that shows, it is not only 11 but 8 that had a material witness which is more severe. what a significant deficiency is is that it is likely that an error or misstatement and a financial statement