Smithsonian Institution
|
|
|
- Eustace Tate
- 8 years ago
- Views:
Transcription
1 Smithsonian Institution Office of the Inspector General Date March 4, 2013 To cc From Subject Albert Horvath, Under Secretary for Finance and Administration and Chief Financial Officer Deron Burba, Chief Information Officer Patricia Bartlett, Chief of Staff, Office of the Secretary Judith Leonard, General Counsel Rebecca Hutchings, Acting Director of IT Security Scott S. Dahl, Inspector General Management Advisory Regarding Portable Computer Encryption (M-13-01) INTRODUCTION In our fiscal year 2010 FISMA review of the Smithsonian s information security program (Smithsonian Institution Information Security Program, March 15, 2011, Report No. A-10-01), we found that the Smithsonian was not enforcing its policy requiring that all mobile devices that may be used to store sensitive information be encrypted. We recommended that the Smithsonian implement controls to ensure that policy is enforced. In a memorandum dated September 30, 2012, management informed us that it implemented the recommendation and requested that we close it. To determine if the actions management took were effective, we examined a sample of portable computers in units that routinely handle sensitive information. We found that most of the portable computers we tested were not encrypted. Management needs to ensure that portable computers that may be used to store sensitive information are properly encrypted. In addition, management needs to ensure that users are aware if a laptop is unencrypted and that it should not be used to store sensitive information. Therefore, we are keeping the recommendation open and making three more recommendations to assist management in implementing the original one. BACKGROUND The Office of Management and Budget issued Memorandum M in June 2006 requiring all executive departments and agencies to encrypt all data on mobile computers/devices which carry agency data, unless the data is determined to be non-sensitive, in writing, by the Deputy Secretary or designee. The Smithsonian is not required to follow OMB memorandums but has issued policies requiring devices containing sensitive data be encrypted.
2 Smithsonian Directive 931, Use of Computers, Telecommunication Devices and Networks, dated September 18, 2009, requires users to ensure that sensitive data stored on laptops or other portable hardware is encrypted. The OCIO technical note IT-930-TN28 establishes the procedures and responsibilities for implementing encryption. According to the technical note, the computing device user is responsible for determining that the device may be used to store sensitive information. The computing device user contacts the unit s IT staff, who is responsible for licensing and installing encryption software. The technical note establishes that whole disk encryption must be used if sensitive data is stored on a laptop computer. In response to the original audit recommendation, management took the following measures: The Office of the Chief Information Officer (OCIO) provided information for Smithsonian units to directly procure a range of approved encrypted devices and encryption software. The CIO distributed a Smithsonian-wide to remind staff of their role and responsibilities for protecting sensitive Smithsonian information using these approved technologies. In addition, OCIO installs encryption on portable or desktop computers on request. RESULTS OF OIG REVIEW In December 2012 and January 2013, we tested a sample of laptops in four units that routinely handle sensitive information and found that many laptop computers were not encrypted. We found that 11 of 15 laptops tested did not have whole disk encryption installed. Of the four units visited, three units did not have encryption installed on any of the laptop computers tested. Several of the computers tested were used by senior-level management. Several staff indicated that they assumed the laptop computers were configured according to Smithsonian requirements and were unaware that encryption was not installed. If a laptop computer that is not secured with encryption is lost or stolen, the information contained on the laptop can be easily obtained without knowledge of user passwords. If the information on the laptop computer is securely encrypted, it would be unlikely or impractical for anyone to retrieve it without the decryption key. CONCLUSION AND RECOMMENDATION The controls in place are not adequate to ensure that laptop computers that may contain sensitive information are secured with an appropriate encryption technology. Staff were not knowledgeable about how the equipment they use was configured and expected it to be configured appropriately for its intended use. Therefore, the original recommendation will remain open and we further recommend that the USFA/CFO, in coordination with the other Under Secretaries, direct Unit IT staff to: 2
3 1. Determine which laptop computers in their inventory may be used to store sensitive data and, with assistance from OCIO, configure those computers with whole drive encryption. 2. Identify all laptop computers that will not be configured with encryption and clearly indicate to users with a prominent label that those computers must not be used to store sensitive information. In addition, we recommend that the Chief Information Officer: 3. Revise IT-930-TN28 to assign responsibility to staff with the knowledge and skills to ensure laptop computers are configured with appropriate encryption technology. Management has concurred with the recommendations and developed a plan to implement them. We believe that the proposed actions, when implemented, will meet the intent of these recommendations. We have included management s full response in Appendix A. We note that the original recommendation is to enforce the existing Smithsonian policy, which requires all mobile devices that may be used to store sensitive information be encrypted. This includes devices such as portable storage, tablets, and smart phones. When requesting that we close the original recommendation, please address how the Smithsonian is implementing its policy with respect to other types of mobile devices. 3
4 APPENDIX A. MANAGEMENT S RESPONSE 4
5 APPENDIX A. MANAGEMENT S RESPONSE (CONTINUED) 5
FY 2013 Evaluation of the Smithsonian Institution s Information Security Program
FY 2013 Evaluation of the Smithsonian Institution s Information Security Program Office of the Inspector General Report Number A-13-10 July 9, 2014 Smithsonian Institution Office of the Inspector General
SMITHSONIAN INSTITUTION
SMITHSONIAN INSTITUTION FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA) 2012 INDEPENDENT EVALUATION REPORT TABLE OF CONTENTS PURPOSE 1 BACKGROUND 1 OBJECTIVES, SCOPE, AND METHODOLOGY 2 SUMMARY OF RESULTS
Department of Homeland Security Office of Inspector General. Audit of Application Controls for FEMA's Individual Assistance Payment Application
Department of Homeland Security Office of Inspector General Audit of Application Controls for FEMA's Individual Assistance Payment Application OIG-09-104 September 2009 Table of Contents Objectives,
VA Office of Inspector General
VA Office of Inspector General OFFICE OF AUDITS AND EVALUATIONS Department of Veterans Affairs Review of Alleged Incomplete Installation of Encryption Software Licenses October 11, 2012 12-01903-04 ACRONYMS
Evaluation of the SEC Encryption Program
Evaluation of the SEC Encryption Program Prepared by C5i Federal, Inc. REDACTED PUBLIC VERSION March 26, 2010 UNITED STATES SECURITIES AND EXCHANGE COMMISSION WASHINGTON, D.C. 20S49 O...lc:E 0.. lh.,.ec:tor
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL INDEPENDENT EVALUATION OF THE NATIONAL CREDIT UNION ADMINISTRATION S COMPLIANCE WITH THE FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA)
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL FOLLOW-UP REVIEW OF NCUA ENCRYPTION Report #OIG-07-11 November 15, 2007 William A. DeSarno Inspector General Released by: Auditor-in-Charge:
POSTAL REGULATORY COMMISSION
POSTAL REGULATORY COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT INFORMATION SECURITY MANAGEMENT AND ACCESS CONTROL POLICIES Audit Report December 17, 2010 Table of Contents INTRODUCTION... 1 Background...1
EVALUATION REPORT. Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review. March 13, 2015 REPORT NUMBER 15-07
EVALUATION REPORT Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review March 13, 2015 REPORT NUMBER 15-07 EXECUTIVE SUMMARY Weaknesses Identified During the FY 2014
REQUEST FOR FINAL ACTION AUDIT 2007-008T PRIVACY PROTECTION TVA USE OF INFORMATION IN IDENTIFIABLE FORM
Memorandum from the Office of the Inspector General July 31, 2007 E. Wayne Robertson, SP 5A-C REQUEST FOR FINAL ACTION AUDIT 2007-008T PRIVACY PROTECTION TVA USE OF INFORMATION IN IDENTIFIABLE FORM Attached
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections Audit Report The Department's Configuration Management of Non-Financial Systems OAS-M-12-02 February 2012 Department
INSPECTION CLOUD COMPUTING SECURITY DOCUMENTATION IN THE CYBER SECURITY ASSESSMENT MANAGEMENT SOLUTION
INSPECTION CLOUD COMPUTING SECURITY DOCUMENTATION IN THE CYBER SECURITY ASSESSMENT MANAGEMENT SOLUTION Report No.: 2015-ITA-017 November 2015 OFFICE OF INSPECTOR GENERAL U.S.DEPARTMENT OF THE INTERIOR
Office of Inspector General
INFORMATION TECHNOLOGY: The Bureau of the Public Debt s Certificate Policy Statement Should Be Updated OIG-03-009 October 24, 2002 Office of Inspector General ******* The Department of the Treasury Contents
Motor Vehicle Fleet Operations. Smithsonian Needs to Update and Implement Vehicle-Related Policies and Procedures
Motor Vehicle Fleet Operations Smithsonian Needs to Update and Implement Vehicle-Related Policies and Procedures Office of the Inspector General Report Number A-13-06 March 27, 2014 Smithsonian Institution
2.0 RECOMMENDATIONS Members of the Committee are asked to note the information contained within this report.
REPORT TO: SCRUTINY COMMITTEE 25 JUNE 2013 REPORT ON: REPORT BY: INTERNAL AUDIT REPORTS CHIEF INTERNAL AUDITOR REPORT NO: 280-2013 1.0 PURPOSE OF REPORT To submit to Members of the Scrutiny Committee a
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL FY 2015 INDEPENDENT EVALUATION OF THE EFFECTIVENESS OF NCUA S INFORMATION SECURITY PROGRAM UNDER THE FEDERAL INFORMATION SECURITY MODERNIZATION
Audit of the Management of Leased Office Space. Smithsonian Needs to Finalize Its Cost-Benefit Analysis to Inform Real Estate Decisions
Audit of the Management of Leased Office Space Smithsonian Needs to Finalize Its Cost-Benefit Analysis to Inform Real Estate Decisions Office of the Inspector General Report Number A-13-12 July 3, 2014
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections Audit Report Management of Bonneville Power Administration's Information Technology Program DOE/IG-0861 March 2012
Status of Cloud Computing Environments within OPM (Report No. 4A-CI-00-14-028)
MEMORANDUM FOR KATHERINE ARCHULETA Director FROM: SUBJECT: PATRICK E. McFARLAND Inspector General Status of Cloud Computing Environments within OPM (Report No. 4A-CI-00-14-028) The purpose of this memorandum
Fiscal Year 2014 Federal Information Security Management Act Report: Status of EPA s Computer Security Program
U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Information Technology Fiscal Year 2014 Federal Information Security Management Act Report: Status of EPA s Computer Security Program Report.
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections. Evaluation Report
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections Evaluation Report The Department's Unclassified Cyber Security Program 2011 DOE/IG-0856 October 2011 Department of
PROCESSING CLASSIFIED INFORMATION ON PORTABLE COMPUTERS IN THE DEPARTMENT OF JUSTICE
PROCESSING CLASSIFIED INFORMATION ON PORTABLE COMPUTERS IN THE DEPARTMENT OF JUSTICE U.S. Department of Justice Office of the Inspector General Audit Division Audit Report 05-32 July 2005 PROCESSING CLASSIFIED
NASA s Management of its Smartphones, Tablets, and Other Mobile Devices
National Aeronautics and Space Administration OFFICE OF INSPECTOR GENERAL NASA s Management of its Smartphones, Tablets, and Other Mobile Devices OFFICE OF AUDITS IG-14-015 (A-12-023-00) AUDIT REPORT FEBRUARY
SECURITY WEAKNESSES IN DOT S COMMON OPERATING ENVIRONMENT EXPOSE ITS SYSTEMS AND DATA TO COMPROMISE
FOR OFFICIAL USE ONLY SECURITY WEAKNESSES IN DOT S COMMON OPERATING ENVIRONMENT EXPOSE ITS SYSTEMS AND DATA TO COMPROMISE Department of Transportation Report No. FI-2013-123 Date Issued: September 10,
AUDIT OF SBA S LOAN APPLICATION TRACKING SYSTEM AUDIT REPORT NUMBER 4-18 APRIL 5, 2004
AUDIT OF SBA S LOAN APPLICATION TRACKING SYSTEM AUDIT REPORT NUMBER 4-18 APRIL 5, 2004 This report may contain proprietary information subject to the provisions of 18 USC 1905 and must not be released
INFORMATION SECURITY AT THE HEALTH RESOURCES AND SERVICES ADMINISTRATION NEEDS IMPROVEMENT BECAUSE CONTROLS WERE NOT FULLY IMPLEMENTED AND MONITORED
Department of Health and Human Services OFFICE OF INSPECTOR GENERAL INFORMATION SECURITY AT THE HEALTH RESOURCES AND SERVICES ADMINISTRATION NEEDS IMPROVEMENT BECAUSE CONTROLS WERE NOT FULLY IMPLEMENTED
Evaluation Report. Weaknesses Identified During the FY 2013 Federal Information Security Management Act Review. April 30, 2014 Report Number 14-12
Evaluation Report Weaknesses Identified During the FY 2013 Federal Information Security Management Act Review April 30, 2014 Report Number 14-12 U.S. Small Business Administration Office of Inspector General
EVALUATION OF THE SMALL BUSINESS ADMINISTRATION'S INFORMATION SECURITY PROGRAM
EVALUATION OF THE SMALL BUSINESS ADMINISTRATION'S INFORMATION SECURITY PROGRAM Report Number: 07-74 Date Issued: February 22, 2007 U.S. Small Buslnws Admlnlstratlon OW- of Inspdor General Memorandum Christine
Department of Homeland Security
for the Immigration and Customs Enforcement Component of the FY 2013 Department of Homeland Security s Financial Statement Audit OIG-14-85 April 2014 OFFICE OF INSPECTOR GENERAL Department of Homeland
Department of Homeland Security
DHS System To Enable Telework Needs a Disaster Recovery Capability OIG-14-55 March 2014 Washington, DC 20528 / www.oig.dhs.gov March 21, 2014 MEMORANDUM FOR: FROM: SUBJECT: Luke J. McCormack Chief Information
REPORT ON FY 2006 FISMA AUDIT OF THE SMITHSONIAN INSTITUTION S INFORMATION SECURITY PROGRAM
REPORT ON FY 2006 FISMA AUDIT OF THE SMITHSONIAN INSTITUTION S INFORMATION SECURITY PROGRAM Cotton & Company LLP Auditors Advisors 635 Slaters Lane, 4 th Floor Alexandria, Virginia 22314 703.836.6701 www.cottoncpa.com
In Brief. Smithsonian Institution Office of the Inspector General. Smithsonian Institution Information Security Program
Smithsonian Institution Office of the Inspector General Smithsonian Institution In Brief Report Number A-11-05, May 15, 2012 Why We Did This Audit The Federal Information Security Management Act of 2002
Office of Inspector General Audit Report
Office of Inspector General Audit Report DOT LACKS AN EFFECTIVE PROCESS FOR ITS TRANSITION TO CLOUD COMPUTING Department of Transportation Report Number: FI-2015-047 Date Issued: June 16, 2015 U.S. Department
FEDERAL ELECTION COMMISSION OFFICE OF INSPECTOR GENERAL
FEDERAL ELECTION COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT Audit of the Federal Election Commission s Fiscal Year 2012 Financial Statements November 2012 ASSIGNMENT No. OIG-12-03 FEDERAL ELECTION
Virginia Commonwealth University School of Medicine Information Security Standard
Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Data Handling and Storage Standard This standard is applicable to all VCU School of Medicine personnel. Approval
Department of Homeland Security Office of Inspector General
Department of Homeland Security Office of Inspector General Vulnerabilities Highlight the Need for More Effective Web Security Management (Redacted) OIG-09-101 September 2009 Office of Inspector General
U.S. DEPARTMENT OF THE INTERIOR OFFICE OF SURFACE MINING RECLAMAION AND ENFORCEMENT DIRECTIVES SYSTEM
U.S. DEPARTMENT OF THE INTERIOR OFFICE OF SURFACE MINING RECLAMAION AND ENFORCEMENT DIRECTIVES SYSTEM Subject: Hardware and Software Management Approval: Brent Wahlquist Subject Number: IT-2 Transmittal
Office of Inspector General
DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,
In Brief. Smithsonian Institution Office of the Inspector General
In Brief Smithsonian Institution Office of the Inspector General Smithsonian Institution Network Infrastructure (SINet) Report Number A-09-01, September 30, 2009 Why We Did This Audit Under the Federal
Memorandum. Audit Report No.: OAS-L-08-04 REPLY TO ATTN OF: Chief Financial Officer, CF-1 TO: INTRODUCTION AND OBJECTIVE
'. 01/29/08 15:22 FAX 301 903 4656 CAPITAL REGION Q002 DOE F 1325.8 (s.9 3 25 United States Government Memorandum DATE: January 28, 2008 REPLY TO ATTN OF: SUBJECT: TO: IG-34 (A07TG029) Department of Energy
Office of Inspector General
DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Improved Administration Can Enhance Federal Emergency Management Agency Laptop Computer Security (Redacted) The Department of Homeland Security,
INTERNATIONAL TRADE ADMINISTRATION Improvements Are Needed to Strengthen ITA s Information Technology Security Program
INTERNATIONAL TRADE ADMINISTRATION Improvements Are Needed to Strengthen ITA s Information Technology Security Program FINAL REPORT NO. OIG-12-037-A SEPTEMBER 27, 2012 U.S. Department of Commerce Office
Audit Report. Mobile Device Security
Audit Report Mobile Device Security A-14-14-14051 September 2014 MEMORANDUM Date: September 26, 2014 Refer To: To: From: The Commissioner Inspector General Subject: Mobile Device Security (A-14-14-14051)
Office of Inspector General Audit Report
Office of Inspector General Audit Report USMMA SECURITY CONTROLS WERE NOT SUFFICIENT TO PROTECT SENSITIVE DATA FROM UNAUTHORIZED ACCESS Maritime Administration Report Number: FI-2012-138 Date Issued: May
AUDIT REPORT. Follow-up on the Department of Energy's Acquisition and Maintenance of Software Licenses
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections AUDIT REPORT Follow-up on the Department of Energy's Acquisition and Maintenance of Software Licenses DOE/IG-0920
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections. Evaluation Report
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections Evaluation Report The Department's Unclassified Cyber Security Program - 2012 DOE/IG-0877 November 2012 MEMORANDUM FOR
Privacy Impact Assessment
Technology, Planning, Architecture, & E-Government Version: 1.1 Date: April 14, 2011 Prepared for: USDA OCIO TPA&E Privacy Impact Assessment for the April 14, 2011 Contact Point Charles McClam Deputy Chief
U.S. Department of Energy Office of Inspector General Office of Audit Services. Audit Report. Security Over Wireless Networking Technologies
U.S. Department of Energy Office of Inspector General Office of Audit Services Audit Report Security Over Wireless Networking Technologies DOE/IG-0617 August 2003 Department of Energy Washington, DC 20585
How To Improve Nasa'S Security
DECEMBER 5, 2011 AUDIT REPORT OFFICE OF AUDITS NASA FACES SIGNIFICANT CHALLENGES IN TRANSITIONING TO A CONTINUOUS MONITORING APPROACH FOR ITS INFORMATION TECHNOLOGY SYSTEMS OFFICE OF INSPECTOR GENERAL
AUDIT REPORT. The Department of Energy's Management of Cloud Computing Activities
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections AUDIT REPORT The Department of Energy's Management of Cloud Computing Activities DOE/IG-0918 September 2014 Department
For: All FSA Employees (Federal and Non-Federal) and Contractors
UNITED STATES DEPARTMENT OF AGRICULTURE Farm Service Agency Washington, DC 20250 Notice IRM-372 For: All FSA Employees (Federal and Non-Federal) and Contractors Interim Encryption Solution Approved for
Office of Inspector General
DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Review of DHS Security Controls for Portable Storage Devices OIG-08-95 September 2008 Office of Inspector General U.S. Department of Homeland
Briefing Report: Improvements Needed in EPA s Information Security Program
U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Briefing Report: Improvements Needed in EPA s Information Security Program Report No. 13-P-0257 May 13, 2013 Scan this mobile code to learn
UNITED STATES DEPARTMENT OF EDUCATION OFFICE OF INSPECTOR GENERAL
UNITED STATES DEPARTMENT OF EDUCATION OFFICE OF INSPECTOR GENERAL THE INSPECTOR GENERAL October 12, 2006 The Honorable Karen S. Evans Administrator for Electronic Government and Information Technology
Statement of Danny Harris, Ph.D. Chief Information Officer U.S. Department of Education
Statement of Danny Harris, Ph.D. Chief Information Officer U.S. Department of Education Before the U.S. House Oversight and Government Reform Committee Hearing on Agency Compliance with the Federal Information
IT SECURITY EDUCATION AWARENESS TRAINING POLICY OCIO-6009-09 TABLE OF CONTENTS
OFFICE OF THE CHIEF INFORMATION OFFICER Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: Section I. PURPOSE II. AUTHORITY III. SCOPE IV. DEFINITIONS V. POLICY VI. RESPONSIBILITIES
THE INFORMATION TECHNOLOGY INFRASTRUCTURE
Department of Health and Human Services OFFICE OF INSPECTOR GENERAL THE INFORMATION TECHNOLOGY INFRASTRUCTURE AND OPERATIONS OFFICE HAD INADEQUATE INFORMATION SECURITY CONTROLS Inquires about this report
Reviews to Determine Architectural Compliance of Information Technology Acquisitions Need to Be Consistently Performed and Documented.
Reviews to Determine Architectural Compliance of Information Technology Acquisitions Need to Be Consistently Performed and Documented November 2003 Reference Number: 2004-20-017 This report has cleared
NARA s Information Security Program. OIG Audit Report No. 15-01. October 27, 2014
NARA s Information Security Program OIG Audit Report No. 15-01 October 27, 2014 Table of Contents Executive Summary... 3 Background... 4 Objectives, Scope, Methodology... 7 Audit Results... 8 Appendix
DOCUMENT NUMBER: IT-0514
SUBJECT: Disaster Recovery Plan EFFECTIVE DATE: 04/15/05 PAGE 1 OF 6 OFFICE OF MIS: DATE: SECRETARY OF DHHR: DATE: 1.0 PURPOSE The purpose of this policy is to specify requirements and responsibilities
HARPER, RAINS, KNIGHT & COMPANY, P.A. CERTIFIED PUBLIC ACCOUNTANTS RIDGELAND, MISSISSIPPI
FARM CREDIT ADMINISTRATION INDEPENDENT ACCOUNTANT S REPORT ON AGREED-UPON PROCEDURES: FEDERAL INFORMATION SECURITY MANAGEMENT ACT EVALUATION For the Year Ending September 30, 2005 HARPER, RAINS, KNIGHT
AUDIT OF USAID s IMPLEMENTATION OF INTERNET PROTOCOL VERSION 6
OFFICE OF INSPECTOR GENERAL AUDIT OF USAID s IMPLEMENTATION OF INTERNET PROTOCOL VERSION 6 AUDIT REPORT NO. A-000-08-006-P September 4, 2008 WASHINGTON, DC Office of Inspector General September 4, 2008
How To Check If Nasa Can Protect Itself From Hackers
SEPTEMBER 16, 2010 AUDIT REPORT OFFICE OF AUDITS REVIEW OF NASA S MANAGEMENT AND OVERSIGHT OF ITS INFORMATION TECHNOLOGY SECURITY PROGRAM OFFICE OF INSPECTOR GENERAL National Aeronautics and Space Administration
ADVISORY MEMORANDUM REPORT ON DEVELOPMENT OF THE LOAN MONITORING SYSTEM ADVISORY REPORT NUMBER A1-03 FEBRUARY 23, 2001
ADVISORY MEMORANDUM REPORT ON DEVELOPMENT OF THE LOAN MONITORING SYSTEM ADVISORY REPORT NUMBER A1-03 FEBRUARY 23, 2001 This report may contain proprietary information subject to the provisions of 18 USC
AUDIT OF NASA S EFFORTS TO CONTINUOUSLY MONITOR CRITICAL INFORMATION TECHNOLOGY SECURITY CONTROLS
SEPTEMBER 14, 2010 AUDIT REPORT OFFICE OF AUDITS AUDIT OF NASA S EFFORTS TO CONTINUOUSLY MONITOR CRITICAL INFORMATION TECHNOLOGY SECURITY CONTROLS OFFICE OF INSPECTOR GENERAL National Aeronautics and Space
W September 14, 1998. Final Report on the Audit of Outsourcing of Desktop Computers (Assignment No. A-HA-97-047) Report No.
W September 14, 1998 TO: FROM: SUBJECT: AO/Chief Information Officer W/Assistant Inspector General for Auditing Final Report on the Audit of Outsourcing of Desktop Computers (Assignment No. A-HA-97-047)
School of Nursing Research Seminar. Data Security in The Academic Health Center. Presented By Jon Harper AHC Information Systems
School of Nursing Research Seminar Data Security in The Academic Health Center Presented By Jon Harper AHC Information Systems 1 Overview of AHC-IS and Supported Services Provide desktop support to ~8500+
This policy applies to all DRC employees, contractors, volunteers, interns and other agents of the state.
STATE OF OHIO SUBJECT: PAGE 1 OF 9 DRC Sensitive Data Security Requirements NUMBER: 05-OIT-23 DEPARTMENT OF REHABILITATION AND CORRECTION RULE/CODE REFERENCE: RELATED ACA STANDARDS: SUPERSEDES: 05-OIT-23
Cloud Computing. Report No. OIG-AMR-74-14-03. UNITED STATES GOVERNMENT National Labor Relations Board Office of Inspector General.
UNITED STATES GOVERNMENT National Labor Relations Board Office of Inspector General Cloud Computing Report No. OIG-AMR-74-14-03 October 21, 2014 CONTENTS EXECUTIVE SUMMARY... 1 BACKGROUND... 2 OBJECTIVE,
March 17, 2015 OIG-15-43
Information Technology Management Letter for the U.S. Citizenship and Immigration Services Component of the FY 2014 Department of Homeland Security Financial Statement Audit March 17, 2015 OIG-15-43 HIGHLIGHTS
Fiscal Year 2007 Federal Information Security Management Act Report
OFFICE OF INSPECTOR GENERAL Special Report Catalyst for Improving the Environment Fiscal Year 2007 Federal Information Security Management Act Report Status of EPA s Computer Security Program Report No.
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections Audit Report Follow-up Audit of the Department's Cyber Security Incident Management Program DOE/IG-0878 December 2012
Office of Inspector General
National Aeronautics and Space Administration Office of Inspector General Washington, DC 20546-0001 February 4, 2010 The Honorable Barbara A. Mikulski Subcommittee on Commerce, Justice, Science, and Related
Privacy Impact Assessment. For. Non-GFE for Remote Access. Date: May 26, 2015. Point of Contact and Author: Michael Gray michael.gray@ed.
For Non-GFE for Remote Access Date: May 26, 2015 Point of Contact and Author: Michael Gray michael.gray@ed.gov System Owner: Allen Hill allen.hill@ed.gov Office of the Chief Information Officer (OCIO)
May 2, 2016 OIG-16-69
Information Technology Management Letter for the United States Secret Service Component of the FY 2015 Department of Homeland Security Financial Statement Audit May 2, 2016 OIG-16-69 DHS OIG HIGHLIGHTS
FISH AND WILDLIFE SERVICE INFORMATION RESOURCES MANAGEMENT. Chapter 7 Information Technology (IT) Security Program 270 FW 7 TABLE OF CONTENTS
TABLE OF CONTENTS General Topics Purpose and Authorities Roles and Responsibilities Policy and Program Waiver Process Contact Abbreviated Sections/Questions 7.1 What is the purpose of this chapter? 7.2
Office of Inspector General
Audit Report OIG-04-017 Review of Assertions Included in the Interagency Crime and Drug Enforcement s Fiscal Year 2003 Annual Accounting of Drug Control Funds January 9, 2004 Office of Inspector General
Hardware Inventory Management Greater Boston District
Hardware Inventory Management Greater Boston District Audit Report Report Number IT-AR-15-004 March 25, 2015 Highlights Management does not have an accurate inventory of hardware assets connected to the
Office of the Inspector General United States Office of Personnel Management. Statement of Michael R. Esser Assistant Inspector General for Audits
Office of the Inspector General United States Office of Personnel Management Statement of Michael R. Esser Assistant Inspector General for Audits before the Committee on Appropriations United States Senate
2008 FISMA Executive Summary Report
2008 FISMA Executive Summary Report PUBLIC REDACTED VERSION September 29, 2008 4B M E M O R A N D U M September 29, 2008 To: From: Lew Walker, Acting Chief Information Officer H. David Kotz, Inspector
Introduction and Purpose... 2 Scope... 2 Auxiliary units... 2. Part-Time, Temporary faculty/staff, Volunteer, Contractor and Student Assistants...
Contents Workstation Refresh & Virtual Desktop Infrastructure Program Introduction and Purpose... 2 Scope... 2 Auxiliary units... 2 Part-Time, Temporary faculty/staff, Volunteer, Contractor and Student
INSPECTION U.S. DEPARTMENT OF THE INTERIOR WEB HOSTING SERVICES
INSPECTION U.S. DEPARTMENT OF THE INTERIOR WEB HOSTING SERVICES Report No.: ISD-IS-OCIO-0001-2014 June 2014 OFFICE OF INSPECTOR GENERAL U.S.DEPARTMENT OF THE INTERIOR Memorandum JUN 0 4 2014 To: From:
MINNESOTA STATE STANDARD
Version: 1.00 Approved Date: 4/29/2011 Approval: Signature on file MINNESOTA STATE STANDARD From the Office of Carolyn Parnell Chief Information Officer, State of Minnesota Enterprise Security Portable
Federal Information Security Management Act: Fiscal Year 2014 Evaluation
Federal Information Security Management Act: Fiscal Year 2014 Evaluation OFFICE OF INSPECTOR GENERAL UNITED STATES SECURITIES AND EXCHANGE COMMISSION WASHINGTON, D.C. 20549 M E M O R A N D U M TO: FROM:
In Brief. Smithsonian Institution Office of the Inspector General. Smithsonian Institution Network Report Number A-06-07, August 10, 2007
Smithsonian Institution Office of the Inspector General In Brief Smithsonian Institution Network Report Number A-06-07, August 10, 2007 Why We Did This Evaluation Under the Federal Information Security
2014 Audit of the CFPB s Information Security Program
O FFICE OF I NSPECTOR GENERAL Audit Report 2014-IT-C-020 2014 Audit of the CFPB s Information Security Program November 14, 2014 B OARD OF G OVERNORS OF THE F EDERAL R ESERVE S YSTEM C ONSUMER FINANCIAL
OFFICE OF THE INSPECTOR GENERAL SOCIAL SECURITY ADMINISTRATION CONTRACT WITH DELL MARKETING, L.P., FOR MICROSOFT LICENSING AND MAINTENANCE
OFFICE OF THE INSPECTOR GENERAL SOCIAL SECURITY ADMINISTRATION CONTRACT WITH DELL MARKETING, L.P., FOR MICROSOFT LICENSING AND MAINTENANCE September 2011 A-06-10-10175 AUDIT REPORT Mis s ion By conducting
2014 Audit of the Board s Information Security Program
O FFICE OF I NSPECTOR GENERAL Audit Report 2014-IT-B-019 2014 Audit of the Board s Information Security Program November 14, 2014 B OARD OF G OVERNORS OF THE F EDERAL R ESERVE S YSTEM C ONSUMER FINANCIAL
Department of Homeland Security Office of Inspector General
Office of Inspector General for the FY 2009 Immigration Customs Enforcement Financial Integrated Audit OIG-10-87 May 2010 Office of Inspector General U.S. Department of Homeland Security Washington, DC
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL SECURITY OF THE NCUA DATA CENTER Report # August 12, 2013 James Hagen Inspector General W. Marvin Stith, CISA Senior IT Auditor Table of
ACTING VICE PRESIDENT, INFORMATION TECHNOLOGY. Michael L. Thompson Acting Deputy Assistant Inspector General for Technology, Investment and Cost
July 14, 2015 MEMORANDUM FOR: JUDITH A. ADAMS ACTING VICE PRESIDENT, INFORMATION TECHNOLOGY FROM: SUBJECT: Michael L. Thompson Acting Deputy Assistant Inspector General for Technology, Investment and Cost
Information Security Series: Security Practices. Integrated Contract Management System
OFFICE OF INSPECTOR GENERAL Audit Report Catalyst for Improving the Environment Information Security Series: Security Practices Integrated Contract Management System Report No. 2006-P-00010 January 31,
Final Audit Report FEDERAL INFORMATION SECURITY MANAGEMENT ACT AUDIT FY 2012. Report No. 4A-CI-00-12-016
U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Subject: FEDERAL INFORMATION SECURITY MANAGEMENT ACT AUDIT FY 2012 Report No. 4A-CI-00-12-016 Date:
Final Audit Report -- CAUTION --
U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Audit of the Information Technology Security Controls of the U.S. Office of Personnel Management
THE UNIVERSITY OF TEXAS-PAN AMERICAN OFFICE OF AUDITS & CONSULTING SERVICES LAPTOP ENCRYPTION. Report No. 13-14
THE UNIVERSITY OF TEXAS-PAN AMERICAN OFFICE OF AUDITS & CONSULTING SERVICES LAPTOP ENCRYPTION Report No. 13-14 OFFICE OF INTERNAL AUDITS THE UNIVERSITY OF TEXAS - PAN AMERICAN 1201 West University Drive
EPA Could Improve Its Information Security by Strengthening Verification and Validation Processes
OFFICE OF INSPECTOR GENERAL Audit Report Catalyst for Improving the Environment EPA Could Improve Its Information Security by Strengthening Verification and Validation Processes Report No. 2006-P-00002
Controls Over the SEC s Inventory of Laptop Computers
Controls Over the SEC s Inventory of Laptop Computers September 22, 2014 Report No. 524 i OFFICE OF INSPECTOR GENERAL UNITED STATES SECURITIES AND EXCHANGE COMMISSION WASHINGTON, D.C. 20549 M E M O R A
Wireless Local Area Network Deployment and Security Practices
HIGHLIGHTS AUDIT REPORT Wireless Local Area Network Deployment and April 24, 2014 Report Number HIGHLIGHTS BACKGROUND: The U.S. Postal Service is committed to providing a high quality, secure, and cost-effective
OFFICIAL USE ONLY. Department of Energy. DATE: January 31, 2007 Audit Report Number: OAS-L-07-06
DOE F 1325.8 (08-93) United States Government Memorandum Department of Energy DATE: January 31, 2007 Audit Report Number: OAS-L-07-06 REPLY TO ATTN OF: SUBJECT: TO: IG-34 (A06TG041) Evaluation of the "Office
U.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL
U.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT: U.S. ELECTION ASSISTANCE COMMISSION EVALUATION OF COMPLIANCE WITH THE REQUIREMENTS OF THE FEDERAL INFORMATION SECURITY MANAGEMENT