How to Ace a FISMA Audit An Auditor s Perspective
|
|
- Claud Cameron
- 7 years ago
- Views:
Transcription
1 How to Ace a FISMA Audit An Auditor s Perspective By Tyler Harding, Principal Kearney & Company tyler.harding@kearneyco.com 1
2 Agenda 1. What can go wrong with the FISMA Audit 2. Different OIG Approaches to FISMA 3. Strategies for Successful Outcomes 4. Anticipating 2012 FISMA OIG Questions 5. Closing Thoughts and Questions 2 2
3 What can go wrong? Wasted hours in countless meetings Endless disagreements with auditors Non-issues reported by OIG IT resources and priorities shifted to address insignificant security risks Real security risks left unaddressed Bad audits hinder Security Program progress High distrust between OIG and Agency Management Agency horror stories 3 3
4 What is a FISMA Audit? FISMA Legislation requires: Each year each agency shall performed an independent evaluation of the information security program and practices of that agency to determine the effectiveness of such program and practices. Each evaluation shall include (a) testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the agency s information systems; (e) The evaluation may be based in whole or in part of an audit, evaluation or reporting relating to programs or practices of the applicable Agency. Problem: OIGs interpret requirement differently 4 4
5 3 Approaches to FISMA Audits Three OIG Approaches to Annual FISMA Audit / Evaluation Requirement Characteristics Audit Evaluation Other Performed to Government Auditing Standards (GAO) - Requires sufficient & appropriate evidence to provide reasonable assurance on conclusions reached. Quality Standards for Inspection & Evaluation (CIGIE) Includes analysis of Agency s Information Security Policies and Procedures to FISMA legislation, OMB, and NIST guidance Includes responses to annual OMB / DHS questions. X X X X X X X Includes test of controls operating effectiveness for a representative subset of agency s information systems. X Increased discussion of control weaknesses (Condition, Cause, Criteria, Effect, & Recommendation) X Increased disclosure of Objective, Scope, Methodology, Sampling Methods, Fraud Considerations, & Criteria Used. X 5 5
6 Key Audit Concepts What is an Audit? Involves the comparison of agency practices to a written standard (OMB, NIST, Agency policy, etc.) Emphasis on internal controls and business processes Audit Implications to Agencies: Golden Rule: If it is not written down, then it doesn t count. Agency policies, procedures and practices need to define in writing the who, what, where, why, and how. Agencies must define their technical standards and baseline security requirements. Can you see the looming problems? 6 6
7 Key FISMA Challenge IT Management Direction: 1. Just get it done 2. I needed XYZ solution deployed yesterday 3. We need to be efficient. OIG / Audit Community Response: 1. Develop policies and procedures 2. Increased emphasis on paperwork 3. More IT security audits (cycle repeats) Final Outcomes 1. Cost effective risk management does not occur 2. FISMA becomes a paper exercise in security How to solve the FISMA Audit Program? 7 7
8 5 Strategies for Success Five Simple Strategies for Success 1. Understand the audit process 2. Practice good Project Management 3. Frequent communication with OIG / Auditor 4. Document only what is necessary 5. Expand Continuous Monitoring Program to include a Pre-FISMA Self Assessment 8 8
9 Strategies for Success: (1) Understand Audit Process Typical FISMA Audit Processes A. Planning Phase 1. Scope & Objectives 2. Audit Announcement Memo 3. Audit Entrance Meeting 4. Process Walkthroughs and Follow Up on Prior Year Findings 5. Auditors release data call (i.e. PBC List) B. Performance Phase 1. Confirm security controls exist and properly designed 2. Detailed interviews with IT personnel 3. Analysis of PBC items 4. Testing of operating control effectiveness 5. Identify control deficiencies 6. OIG and IT Department hold periodic status meetings C. Reporting Phase 1. Develop and issue written findings (Notice of Findings and Recommendations) 2. IT responds to individual findings 3. OIG issues draft report inclusive of all significant findings for management comment 4. OIG and IT Department hold an Exit Meeting to discuss audit results and conclusion 5. OIG revises draft report and issues final report with management comments 9 9
10 Strategies for Success: (2) Practice Project Management Suggested Project Management Activities for Success (Pre-Audit) 1. Assign Senior Management Official to be responsible for Pre-FISMA effort 2. Create a simple Project Plan to prepare for the FISMA Audit 3. Review prior year FISMA audit issues 4. Review prior year FISMA data requests for insight into testing approach. 5. Update PBC documents frequently requested (i.e. Agency IT security policies, organizational charts, etc.) by auditors 2-3 months prior to audit. 6. Update Plans of Actions and Milestones 7. Update Continuous Monitoring Approach 8. Conduct a Pre-Audit of commonly tested audit areas and triage weaknesses 9. Request the Auditor s FISMA PBC list 4 weeks in advance of audit. Project Management Goal: Get the IT auditors OUT of your IT Department fast! Shorter IT Audits Translate into: 1. Fewer Audit Findings 2. Focused FISMA Audit or Evaluation 3. Fewer distractions for IT Department 4. Happy OIG, CIO and Agency Management 10 10
11 Strategies for Success: (3) Frequent Communication Suggested Communication Activities 1. Assign Senior Management Official to be responsible for communicating with IT Auditors 2. Assign a single Agency Point of Contact for all data requests (i.e. preferably an Internal Control specialist with audit experience) 3. Contact OIG / External Auditors to learn testing timeframe, testing approach, etc. 3-6 months before the FISMA Audit begins 4. Request the Auditor s FISMA PBC list and necessary meetings (walkthroughs) 4 weeks in advance of FISMA audit start. 5. Schedule meetings between IT Department and IT Auditor well in advance (2 weeks +) 6. Develop Ground Rules for ad-hoc meetings during the audit a. Meeting Agenda distributed 48 hours in advance of any scheduled meetings b. Required meeting attendees 7. Kick Off Meeting Cover Key FISMA Audit Areas a. Agency s implementation of NIST Risk Management Framework and Agency Security Policy b. Ground Rules for managing and reporting findings Agency needs sufficient time (7 days) to verify facts and respond to any recommendations. c. Auditor s Project Timeline (When are responses due back to OIG). 8. Require weekly meetings to (a) review updates to PBC list with Auditor, (b) discuss preliminary concerns / observations, and (b) confirm last day of fieldwork! Goals of Frequent Communication: 1. Happy auditors are more understanding IT challenges 2. Get the IT Auditors IN and OUT of your IT Department fast 3. Avoid instances of miscommunication 4. Establish reasonable project timelines 5. Provide IT Department adequate time to respond to findings
12 Strategies for Success: (4) Targeted Documentation Targeted Documentation Activities 1. Adopt a Keep-It-Simple-Stupid (KISS) strategy a. Do not over document b. Utilize templates (MS Excel, MS Word) where ever possible c. Avoid regurgitating NIST SP controls 2. Prioritize documentation efforts a. Prior year findings b. Updates to existing security policies to meet OMB / DHS requirements c. Frequently requested PBC items (POA&Ms, Contingency Plans) d. Current year OMB / DHS priority areas (Continuous Monitoring Plan) Goals of Targeted Documentation: 1. Avoid documentation for auditor s sake 2. Document only what is necessary to establish Agency standard 3. Avoid petty findings of Establish policies and procedures to 12 12
13 Strategies for Success: (5) Pre-FISMA Self Assessment Suggested Pre-FISMA Self Assessment Activities 1. Identify frequently tested FISMA Audit areas with operational components a. Access Controls (Employee separations, Employee transfers) b. Configuration Management c. Vulnerability Management (Security patching, vulnerability identification, and remediation) d. Plans of Actions & Milestones e. Contingency Plan Testing / Disaster Recovery 2. Integrate FISMA Self-Assessment activities into broader Continuous Monitoring Program Goals of Pre-FISMA Self Assessments 1. Identify and correct weaknesses before the IT auditors do. 2. Demonstrate automated and manual aspects of Continuous Monitoring 3. Improve Agency risk management practices and security posture 13 13
14 Draft 2012 OIG FISMA Questions Proposed 2012 OIG FISMA Questions (January 2012 Draft) 1. OIGs to validate accuracy of 2011 CIO Responses. 2. Inclusion of cloud computing questions in FISMA Inventory 3. Emphasis to evaluate Agency s Continuous Monitoring Program 4. Expansion from 11 questions to 17 OIG FISMA Questions. Each question has 5 to 8 sub-questions. 5. New OIG questions in areas of Cloud Computing, Asset Management, Vulnerability Management, Data Protection, Boundary Protection, Network Security Protocols, and Enterprise Security Architecture. 6. Each OIG question has a quantitative aspect and a subjective aspect (i.e. compare and contrast question). (Caveat 2012 OIG Questions were draft and are likely to change.) General Observations 1. Positive change to see emphasis on real-time risk management via automation versus emphasis on paper compliance. 2. Overall OIG questions are more technical than prior years, particularly in areas of network boundary protection and perimeter network security protocols. 3. Level of effort to prepare OIG FISMA responses significantly greater than prior years. 4. OIG s directed to report significant issues rather than minor items of non-compliance
15 Closing Thoughts A computer lets you make more mistakes faster than any invention in human history - with the possible exceptions of handguns and tequila. Mitch Radcliffe Questions Contact Information Tyler Harding, Principal tyler.harding@kearneyco.com Phone:
Independent Evaluation of NRC s Implementation of the Federal Information Security Modernization Act of 2014 for Fiscal Year 2015
Independent Evaluation of NRC s Implementation of the Federal Information Security Modernization Act of 2014 for Fiscal Year 2015 OIG-16-A-03 November 12, 2015 All publicly available OIG reports (including
More information5 FAH-11 H-500 PERFORMANCE MEASURES FOR INFORMATION ASSURANCE
5 FAH-11 H-500 PERFORMANCE MEASURES FOR INFORMATION ASSURANCE 5 FAH-11 H-510 GENERAL (Office of Origin: IRM/IA) 5 FAH-11 H-511 INTRODUCTION 5 FAH-11 H-511.1 Purpose a. This subchapter implements the policy
More informationOffice of Inspector General
DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,
More informationFiscal Year 2014 Federal Information Security Management Act Report: Status of EPA s Computer Security Program
U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Information Technology Fiscal Year 2014 Federal Information Security Management Act Report: Status of EPA s Computer Security Program Report.
More informationUNITED STATES COMMISSION ON CIVIL RIGHTS. Fiscal Year 2012 Federal Information Security Management Act Evaluation
Memorandum UNITED STATES COMMISSION ON CIVIL RIGHTS Date: November 15, 2012 To: From: Subject: The Honorable Commissioners Frances Garcia, Inspector General Fiscal Year 2012 Federal Information Security
More informationEvaluation Report. Weaknesses Identified During the FY 2013 Federal Information Security Management Act Review. April 30, 2014 Report Number 14-12
Evaluation Report Weaknesses Identified During the FY 2013 Federal Information Security Management Act Review April 30, 2014 Report Number 14-12 U.S. Small Business Administration Office of Inspector General
More informationNATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL INDEPENDENT EVALUATION OF THE NATIONAL CREDIT UNION ADMINISTRATION S COMPLIANCE WITH THE FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA)
More informationUnited States Patent and Trademark Office
U.S. DEPARTMENT OF COMMERCE Office of Inspector General United States Patent and Trademark Office FY 2009 FISMA Assessment of the Patent Cooperation Treaty Search Recordation System (PTOC-018-00) Final
More informationU.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS. Final Audit Report
U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Audit of the Information Technology Security Controls of the U.S. Office of Personnel Management
More informationEVALUATION REPORT. Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review. March 13, 2015 REPORT NUMBER 15-07
EVALUATION REPORT Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review March 13, 2015 REPORT NUMBER 15-07 EXECUTIVE SUMMARY Weaknesses Identified During the FY 2014
More informationOFFICE OF INSPECTOR GENERAL
OFFICE OF INSPECTOR GENERAL Audit Report Catalyst for Improving the Environment Evaluation of U.S. Chemical Safety and Hazard Investigation Board s Compliance with the Federal Information Security Management
More informationFinal Audit Report -- CAUTION --
U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Audit of the Information Technology Security Controls of the U.S. Office of Personnel Management
More informationPOSTAL REGULATORY COMMISSION
POSTAL REGULATORY COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT INFORMATION SECURITY MANAGEMENT AND ACCESS CONTROL POLICIES Audit Report December 17, 2010 Table of Contents INTRODUCTION... 1 Background...1
More informationU.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL
U.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT: U.S. Election Assistance Commission Compliance with the Requirements of the Federal Information Security Management Act Fiscal
More informationINSPECTION U.S. DEPARTMENT OF THE INTERIOR WEB HOSTING SERVICES
INSPECTION U.S. DEPARTMENT OF THE INTERIOR WEB HOSTING SERVICES Report No.: ISD-IS-OCIO-0001-2014 June 2014 OFFICE OF INSPECTOR GENERAL U.S.DEPARTMENT OF THE INTERIOR Memorandum JUN 0 4 2014 To: From:
More information2014 Audit of the Board s Information Security Program
O FFICE OF I NSPECTOR GENERAL Audit Report 2014-IT-B-019 2014 Audit of the Board s Information Security Program November 14, 2014 B OARD OF G OVERNORS OF THE F EDERAL R ESERVE S YSTEM C ONSUMER FINANCIAL
More informationIG ISCM MATURITY MODEL FOR FY 2015 FISMA FOR OFFICIAL USE ONLY
IG MATURITY MODEL FOR FY 2015 FISMA 1 Ad-hoc 1.1 program is not formalized and activities are performed in a reactive manner resulting in an adhoc program that does not meet 2 requirements for a defined
More informationCybersecurity Risk Management Activities Instructions Fiscal Year 2015
Cybersecurity Risk Management Activities Instructions Fiscal Year 2015 An effective risk management program and compliance with the Federal Information Security Management Act (FISMA) requires the U.S.
More informationHow To Check If Nasa Can Protect Itself From Hackers
SEPTEMBER 16, 2010 AUDIT REPORT OFFICE OF AUDITS REVIEW OF NASA S MANAGEMENT AND OVERSIGHT OF ITS INFORMATION TECHNOLOGY SECURITY PROGRAM OFFICE OF INSPECTOR GENERAL National Aeronautics and Space Administration
More informationNARA s Information Security Program. OIG Audit Report No. 15-01. October 27, 2014
NARA s Information Security Program OIG Audit Report No. 15-01 October 27, 2014 Table of Contents Executive Summary... 3 Background... 4 Objectives, Scope, Methodology... 7 Audit Results... 8 Appendix
More informationCTR System Report - 2008 FISMA
CTR System Report - 2008 FISMA February 27, 2009 TABLE of CONTENTS BACKGROUND AND OBJECTIVES... 5 BACKGROUND... 5 OBJECTIVES... 6 Classes and Families of Security Controls... 6 Control Classes... 7 Control
More information2012 FISMA Executive Summary Report
2012 FISMA Executive Summary Report March 29, 2013 UNITED STATES SECURITIES AND EXCHANGE COMMISSION WASHINGTON, D.C. 20549 OI'!'ICEOI' lnstfl! C1'0R GENERAt MEMORANDUM March 29,2013 To: Jeff Heslop, Chief
More informationOffice of Inspector General
Office of Inspector General DEPARTMENT OF HOMELAND SECURITY U.S. Department of Homeland Security Washington, DC 20528 Office of Inspector General Security Weaknesses Increase Risks to Critical DHS Databases
More informationReview of the SEC s Systems Certification and Accreditation Process
Review of the SEC s Systems Certification and Accreditation Process March 27, 2013 Page i Should you have any questions regarding this report, please do not hesitate to contact me. We appreciate the courtesy
More informationTREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION Treasury Inspector General for Tax Administration Federal Information Security Management Act Report October 27, 2009 Reference Number: 2010-20-004 This
More informationVA Office of Inspector General
VA Office of Inspector General OFFICE OF AUDITS & EVALUATIONS Department of Veterans Affairs Federal Information Security Management Act Audit for Fiscal Year 2013 May 29, 2014 13-01391-72 ACRONYMS AND
More informationOverview. FedRAMP CONOPS
Concept of Operations (CONOPS) Version 1.0 February 7, 2012 Overview Cloud computing technology allows the Federal Government to address demand from citizens for better, faster services and to save resources,
More informationFY 2016 Inspector General Federal Information Security Modernization Act of 2014 Reporting Metrics V1.0
FY 2016 Inspector General Federal Information Security Modernization Act of 2014 Reporting Metrics V1.0 June 20, 2016 Document History Version Date Comments Sec/Page 1.0 19 June 2016 Aligned questions
More informationINFORMATION SECURITY. Evaluation of GAO s Program and Practices for Fiscal Year 2012 OIG-13-2
INFORMATION SECURITY Evaluation of GAO s Program and Practices for Fiscal Year 2012 OIG-13-2 Office of the Inspector General U.S. Government Accountability Office Report Highlights February 2013 INFORMATION
More informationAudit of the Board s Information Security Program
Board of Governors of the Federal Reserve System Audit of the Board s Information Security Program Office of Inspector General November 2011 November 14, 2011 Board of Governors of the Federal Reserve
More informationEPA Needs to Improve Security Planning and Remediation of Identified Weaknesses in Systems Used to Protect Human Health and the Environment
U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Information Technology EPA Needs to Improve Security Planning and Remediation of Identified Weaknesses in Systems Used to Protect Human
More informationFiscal Year 2007 Federal Information Security Management Act Report
OFFICE OF INSPECTOR GENERAL Special Report Catalyst for Improving the Environment Fiscal Year 2007 Federal Information Security Management Act Report Status of EPA s Computer Security Program Report No.
More information4 Testing General and Automated Controls
4 Testing General and Automated Controls Learning Objectives To understand the reasons for testing; To have an idea about Audit Planning and Testing; To discuss testing critical control points; To learn
More informationACSAC NOAA/NESDIS Case Study. December, 2006
ACSAC NOAA/NESDIS Case Study December, 2006 History in Brief FISMA enacted in 2002 IG testimony to Congress June 2003 cited 6 OMB weaknesses and DOC response. OMB issues reporting guidance and template
More informationFollowing is a discussion of the Hub s role within the health insurance exchanges, the results of our review, and concluding observations.
Testimony of: Kay Daly Assistant Inspector General for Audit Services Office of Inspector General, U.S. Department of Health and Human Services Hearing Title: The Threat to Americans Personal Information:
More informationFinal Audit Report. Report No. 4A-CI-OO-12-014
U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Subject: AUDIT OF THE INFORMATION TECHNOLOGY SECURITY CONTROLS OF THE U.S. OFFICE OF PERSONNEL MANAGEMENT'S
More informationREVIEW OF THE DEPARTMENT OF HEALTH AND HUMAN SERVICES COMPLIANCE WITH THE FEDERAL INFORMATION SECURITY MODERNIZATION ACT OF 2014 FOR FISCAL YEAR 2015
Department of Health and Human Services OFFICE OF INSPECTOR GENERAL REVIEW OF THE DEPARTMENT OF HEALTH AND HUMAN SERVICES COMPLIANCE WITH THE FEDERAL INFORMATION SECURITY MODERNIZATION ACT OF 2014 FOR
More informationFREQUENTLY ASKED QUESTIONS
FREQUENTLY ASKED QUESTIONS Continuous Monitoring 1. What is continuous monitoring? Continuous monitoring is one of six steps in the Risk Management Framework (RMF) described in NIST Special Publication
More informationFY 2015 Inspector General Federal Information Security Modernization Act Reporting Metrics V1.2
FY 2015 Inspector General Federal Information Security Modernization Act Reporting Metrics V1.2 Prepared by: U.S. Department of Homeland Security Office of Cybersecurity and Communications Federal Network
More informationSecurity Control Standard
Department of the Interior Security Control Standard Security Assessment and Authorization January 2012 Version: 1.2 Signature Approval Page Designated Official Bernard J. Mazer, Department of the Interior,
More informationInternational Trade Administration
U.S. DEPARTMENT OF COMMERCE Office of Inspector General International Trade Administration FY 2007 FISMA Assessment of Core Network General Support System (ITA-012) Final Inspection Report No. OSE-18840/September
More informationREPORT ON FY 2006 FISMA AUDIT OF THE SMITHSONIAN INSTITUTION S INFORMATION SECURITY PROGRAM
REPORT ON FY 2006 FISMA AUDIT OF THE SMITHSONIAN INSTITUTION S INFORMATION SECURITY PROGRAM Cotton & Company LLP Auditors Advisors 635 Slaters Lane, 4 th Floor Alexandria, Virginia 22314 703.836.6701 www.cottoncpa.com
More informationU.S. DEPARTMENT OF THE INTERIOR OFFICE OF INSPECTOR GENERAL Verification of Previous Office of Inspector General Recommendations September 2009
U.S. DEPARTMENT OF THE INTERIOR OFFICE OF INSPECTOR GENERAL Verification of Previous Office of Inspector General Recommendations September 2009 ISD-EV-MOA-0002-2009 Contents Acronyms and Other Reference
More informationAUDIT REPORT. The Energy Information Administration s Information Technology Program
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections AUDIT REPORT The Energy Information Administration s Information Technology Program DOE-OIG-16-04 November 2015 Department
More informationAudit Report. The Social Security Administration s Compliance with the Federal Information Security Management Act of 2002 for Fiscal Year 2013
Audit Report The Social Security Administration s Compliance with the Federal Information Security Management Act of 2002 for Fiscal Year 2013 A-14-13-13086 November 2013 MEMORANDUM Date: November 26,
More informationWhy are PMO s are Needed on Large Projects?
Why are PMO s are Needed on Large Projects? Keeps Project Manager focused on: Priority risks Priority issues Stakeholder alignment Technical challenges Ensures administrative tasks are completed: Projects
More informationAudit of the Data Center Consolidation Initiative at NARA. OIG Draft Audit Report No. 12-09. May 10, 2012
Audit of the Data Center Consolidation Initiative at NARA OIG Draft Audit Report No. 12-09 May 10, 2012 Table of Contents Executive Summary... 3 Background... 4 Objectives, Scope, Methodology... 7 Audit
More informationMANAGING THE CONFIGURATION OF INFORMATION SYSTEMS WITH A FOCUS ON SECURITY
MANAGING THE CONFIGURATION OF INFORMATION SYSTEMS WITH A FOCUS ON SECURITY Shirley Radack, Editor Computer Security Division Information Technology Laboratory National Institute of Standards and Technology
More informationCIP 010 1 Cyber Security Configuration Change Management and Vulnerability Assessments
CIP 010 1 Cyber Security Configuration Change Management and Vulnerability Assessments A. Introduction 1. Title: Cyber Security Configuration Change Management and Vulnerability Assessments 2. Number:
More informationIBM Internet Security Systems October 2007. FISMA Compliance A Holistic Approach to FISMA and Information Security
IBM Internet Security Systems October 2007 FISMA Compliance A Holistic Approach to FISMA and Information Security Page 1 Contents 1 Executive Summary 1 FISMA Overview 3 Agency Challenges 4 The IBM ISS
More informationAUDIT REPORT. Cybersecurity Controls Over a Major National Nuclear Security Administration Information System
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections AUDIT REPORT Cybersecurity Controls Over a Major National Nuclear Security Administration Information System DOE/IG-0938
More informationNEIAF June 18, 2015. IS Auditing 101
NEIAF June 18, 2015 IS Auditing 101 http://www.gao.gov/fiscam/overview Planning Understand the Overall Audit Objectives and Related Scope of the Information System Controls Audit Understand the Entity
More informationFedRAMP Standard Contract Language
FedRAMP Standard Contract Language FedRAMP has developed a security contract clause template to assist federal agencies in procuring cloud-based services. This template should be reviewed by a Federal
More informationFISH AND WILDLIFE SERVICE INFORMATION RESOURCES MANAGEMENT. Chapter 7 Information Technology (IT) Security Program 270 FW 7 TABLE OF CONTENTS
TABLE OF CONTENTS General Topics Purpose and Authorities Roles and Responsibilities Policy and Program Waiver Process Contact Abbreviated Sections/Questions 7.1 What is the purpose of this chapter? 7.2
More informationState of Oregon. State of Oregon 1
State of Oregon State of Oregon 1 Table of Contents 1. Introduction...1 2. Information Asset Management...2 3. Communication Operations...7 3.3 Workstation Management... 7 3.9 Log management... 11 4. Information
More informationOffice of the Auditor General Performance Audit Report. Statewide UNIX Security Controls Department of Technology, Management, and Budget
Office of the Auditor General Performance Audit Report Statewide UNIX Security Controls Department of Technology, Management, and Budget December 2015 State of Michigan Auditor General Doug A. Ringler,
More informationU.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL
U.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT: U.S. ELECTION ASSISTANCE COMMISSION EVALUATION OF COMPLIANCE WITH THE REQUIREMENTS OF THE FEDERAL INFORMATION SECURITY MANAGEMENT
More informationFinal Audit Report FEDERAL INFORMATION SECURITY MANAGEMENT ACT AUDIT FY 2012. Report No. 4A-CI-00-12-016
U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Subject: FEDERAL INFORMATION SECURITY MANAGEMENT ACT AUDIT FY 2012 Report No. 4A-CI-00-12-016 Date:
More informationInformation Security Series: Security Practices. Integrated Contract Management System
OFFICE OF INSPECTOR GENERAL Audit Report Catalyst for Improving the Environment Information Security Series: Security Practices Integrated Contract Management System Report No. 2006-P-00010 January 31,
More informationInternal Audit Checklist
Internal Audit Checklist 4.2 Policy Verify required elements Verify management commitment Verify available to the public Verify implementation by tracing links back to policy statement Check review/revisions
More informationSTATEMENT OF JOHN E. MCCOY II DEPUTY ASSISTANT INSPECTOR GENERAL FOR AUDITS U.S. DEPARTMENT OF HOMELAND SECURITY BEFORE THE
STATEMENT OF JOHN E. MCCOY II DEPUTY ASSISTANT INSPECTOR GENERAL FOR AUDITS U.S. DEPARTMENT OF HOMELAND SECURITY BEFORE THE COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM SUBCOMMITTEE ON GOVERNMENT ORGANIZATION,
More informationSMITHSONIAN INSTITUTION
SMITHSONIAN INSTITUTION FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA) 2012 INDEPENDENT EVALUATION REPORT TABLE OF CONTENTS PURPOSE 1 BACKGROUND 1 OBJECTIVES, SCOPE, AND METHODOLOGY 2 SUMMARY OF RESULTS
More informationFinal Audit Report -- CAUTION --
U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Audit of Information Systems General and Application Controls and Administrative Expense Review at
More informationPlan of Action and Milestones (POA&M) Training Session
Plan of Action and Milestones (POA&M) Training Session Jamie Nicholson IM-31, Policy, Guidance, & Planning Division U.S. Department of Energy Office of the Associate CIO for Cyber Security 1 Objectives
More informationOFFICE OF INSPECTOR GENERAL. Audit Report. Evaluation of the Railroad Retirement Board Medicare Contractor s Information Security
OFFICE OF INSPECTOR GENERAL Audit Report Evaluation of the Railroad Retirement Board Medicare Contractor s Information Security Report No. 08-04 September 26, 2008 RAILROAD RETIREMENT BOARD INTRODUCTION
More informationVA Office of Inspector General
VA Office of Inspector General OFFICE OF AUDITS & EVALUATIONS Department of Veterans Affairs Federal Information Security Management Act Audit for Fiscal Year 2014 May 19, 2015 14-01820-355 ACRONYMS CRISP
More informationDepartment of Homeland Security
Evaluation of DHS Information Security Program for Fiscal Year 2013 OIG-14-09 November 2013 Washington, DC 20528 / www.oig.dhs.gov November 21, 2013 MEMORANDUM FOR: FROM: SUBJECT: Jeffrey Eisensmith Chief
More information2008 FISMA Executive Summary Report
2008 FISMA Executive Summary Report PUBLIC REDACTED VERSION September 29, 2008 4B M E M O R A N D U M September 29, 2008 To: From: Lew Walker, Acting Chief Information Officer H. David Kotz, Inspector
More informationVA Office of Inspector General
VA Office of Inspector General OFFICE OF AUDITS & EVALUATIONS Department of Veterans Affairs Federal Information Security Modernization Act Audit for Fiscal Year 2015 March 15, 2016 15-01957-100 ACRONYMS
More informationSecurity Controls Assessment for Federal Information Systems
Security Controls Assessment for Federal Information Systems Census Software Process Improvement Program September 11, 2008 Kevin Stine Computer Security Division National Institute of Standards and Technology
More informationInformation Security for Managers
Fiscal Year 2015 Information Security for Managers Introduction Information Security Overview Enterprise Performance Life Cycle Enterprise Performance Life Cycle and the Risk Management Framework Categorize
More informationReport of Evaluation OFFICE OF INSPECTOR GENERAL E-09-01. Tammy Rapp Auditor-in-Charge FARM CREDIT ADMINISTRATION
OFFICE OF INSPECTOR GENERAL Report of Evaluation OIG 2009 Evaluation of the Farm Credit Administration s Compliance with the Federal Information Security Management Act E-09-01 November 18, 2009 Tammy
More informationAuditing in the New Millennium:
: Information Technology Controls and Network Vulnerability Assessments Ernie Barany, CPA, CPT, CEH Principal Auditor Dan Altobelli, CPA, CISA, CEH Principal Auditor 1 When you think of IT auditing, is
More informationIn Brief. Smithsonian Institution Office of the Inspector General
In Brief Smithsonian Institution Office of the Inspector General Smithsonian Institution Network Infrastructure (SINet) Report Number A-09-01, September 30, 2009 Why We Did This Audit Under the Federal
More informationAgency Security - What Are the Advantages and Disadvantages
EXECUTIVE OFFICE OF THE PRESIDENT OFFICE OF MANAGEMENT AND BUDGET WASHINGTON, D.C. 20503 The Director M-04-25 August 23, 2004 MEMORANDUM FOR HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES FROM: SUBJECT: Joshua
More informationChapter 5. Planning the Audit Engagement
Chapter 5 Planning the Audit Engagement A. Purpose for Planning the Engagement Engagement planning is performed to provide a means for developing an understanding of the business objectives of the auditee,
More informationCHAPTER 5 - SAFETY ASSESSMENTS, LOG OF DEFICIENCIES AND CORRECTIVE ACTION PLANS
CHAPTER 5 - SAFETY ASSESSMENTS, LOG OF DEFICIENCIES AND CORRECTIVE ACTION PLANS A. INTRODUCTION... 1 B. CHAPTER-SPECIFIC ROLES AND RESPONSIBILITIES... 1 C. SAFETY PROGRAM ASSESSMENT PROCESS... 3 D. FACILITY-MAINTAINED
More informationHow To Improve Nasa'S Security
DECEMBER 5, 2011 AUDIT REPORT OFFICE OF AUDITS NASA FACES SIGNIFICANT CHALLENGES IN TRANSITIONING TO A CONTINUOUS MONITORING APPROACH FOR ITS INFORMATION TECHNOLOGY SYSTEMS OFFICE OF INSPECTOR GENERAL
More informationNIST 800-53A: Guide for Assessing the Security Controls in Federal Information Systems. Samuel R. Ashmore Margarita Castillo Barry Gavrich
NIST 800-53A: Guide for Assessing the Security Controls in Federal Information Systems Samuel R. Ashmore Margarita Castillo Barry Gavrich CS589 Information & Risk Management New Mexico Tech Spring 2007
More informationContinuous Monitoring in a Risk Management Framework. US Census Bureau Oct 2012
Monitoring in a Risk Management Framework US Census Bureau Oct 2012 Agenda Drivers for Monitoring What is Monitoring Monitoring in a Risk Management Framework (RMF) RMF Cost Efficiencies RMF Lessons Learned
More informationSECURITY WEAKNESSES IN DOT S COMMON OPERATING ENVIRONMENT EXPOSE ITS SYSTEMS AND DATA TO COMPROMISE
FOR OFFICIAL USE ONLY SECURITY WEAKNESSES IN DOT S COMMON OPERATING ENVIRONMENT EXPOSE ITS SYSTEMS AND DATA TO COMPROMISE Department of Transportation Report No. FI-2013-123 Date Issued: September 10,
More informationLots of Updates! Where do we start?
NIH Security, FISMA and EPLC Lots of Updates! Where do we start? Kay Coupe NIH FISMA Program Coordinator Office of the Chief Information Officer Project Management Community Meeting October 18, 2011 .
More informationJanuary 15, 2016. Office of Inspector General (OIG)
January 15, 2016 Office of Inspector General (OIG) Audit Report No. 16-02, CliftonLarsonAllen, LLP Audit of NARA s Compliance with FISMA, As Amended David S. Ferriero, Archivist of the United States (N)
More informationEPA s Computer Security Self-Assessment Process Needs Improvement
OFFICE OF INSPECTOR GENERAL Catalyst for Improving the Environment Audit Report EPA s Computer Security Self-Assessment Process Needs Improvement Report No. 2003-P-00017 September 30, 2003 Report Contributors:
More informationREVIEW OF MEDICARE CONTRACTOR INFORMATION SECURITY PROGRAM EVALUATIONS FOR FISCAL YEAR 2013
Department of Health and Human Services OFFICE OF INSPECTOR GENERAL REVIEW OF MEDICARE CONTRACTOR INFORMATION SECURITY PROGRAM EVALUATIONS FOR FISCAL YEAR 2013 Inquiries about this report may be addressed
More informationOffice of Inspector General Corporation for National and Community Service
Office of Inspector General Corporation for National and Community Service FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA) INDEPENDENT EVALUATION FOR FY 2013 OIG REPORT 14-03 1201 New York Ave, NW
More informationEXECUTIVE OFFICE OF THE PRESIDENT OFFICE OF MANAGEMENT AND BUDGET WASHINGTON, D.C. 20503
EXECUTIVE OFFICE OF THE PRESIDENT OFFICE OF MANAGEMENT AND BUDGET WASHINGTON, D.C. 20503 THE DIRECTOR August 6, 2003 M-03-19 MEMORANDUM FOR HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES FROM: SUBJECT: Joshua
More informationSecure Content Automation Protocol (SCAP): How it is increasingly used to automate enterprise security management activities
Secure Content Automation Protocol (SCAP): How it is increasingly used to automate enterprise security management activities Sean Barnum sbarnum@mitre.org September 2011 Overview What is SCAP? Why SCAP?
More informationAudit Report. Management of Naval Reactors' Cyber Security Program
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections Audit Report Management of Naval Reactors' Cyber Security Program DOE/IG-0884 April 2013 Department of Energy Washington,
More informationU.S. Department of Energy Office of Inspector General Office of Audits & Inspections. Evaluation Report
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections Evaluation Report The Department's Unclassified Cyber Security Program - 2012 DOE/IG-0877 November 2012 MEMORANDUM FOR
More informationCloud Computing. Report No. OIG-AMR-74-14-03. UNITED STATES GOVERNMENT National Labor Relations Board Office of Inspector General.
UNITED STATES GOVERNMENT National Labor Relations Board Office of Inspector General Cloud Computing Report No. OIG-AMR-74-14-03 October 21, 2014 CONTENTS EXECUTIVE SUMMARY... 1 BACKGROUND... 2 OBJECTIVE,
More informationReport of Evaluation OFFICE OF INSPECTOR GENERAL. OIG 2014 Evaluation of the Farm Credit OIG 2014 Administration s. Management Act.
OFFICE OF INSPECTOR GENERAL Report of Evaluation OIG 2014 Evaluation of the Farm Credit OIG 2014 Administration s Evaluation of the Farm Compliance Credit Administration s with the Federal Information
More informationThe Certification and Accreditation of Computer Systems Should Remain in the Computer Security Material Weakness. August 2004
The Certification and Accreditation of Computer Systems Should Remain in the Computer Security Material Weakness August 2004 Reference Number: 2004-20-129 This report has cleared the Treasury Inspector
More informationOFFICIAL USE ONLY. Department of Energy. DATE: January 31, 2007 Audit Report Number: OAS-L-07-06
DOE F 1325.8 (08-93) United States Government Memorandum Department of Energy DATE: January 31, 2007 Audit Report Number: OAS-L-07-06 REPLY TO ATTN OF: SUBJECT: TO: IG-34 (A06TG041) Evaluation of the "Office
More informationDeputy Chief Financial Officer Peggy Sherry. And. Chief Information Security Officer Robert West. U.S. Department of Homeland Security.
Deputy Chief Financial Officer Peggy Sherry And Chief Information Security Officer Robert West U.S. Department of Homeland Security Testimony Before the Subcommittee on Government Organization, Efficiency
More informationNASA OFFICE OF INSPECTOR GENERAL
NASA OFFICE OF INSPECTOR GENERAL OFFICE OF AUDITS SUITE 8U71, 300 E ST SW WASHINGTON, D.C. 20546-0001 April 14, 2016 TO: SUBJECT: Renee P. Wynn Chief Information Officer Final Memorandum, Review of NASA
More informationAudit Report on the New York City Police Department Data Center 7A06-093
Audit Report on the New York City Police Department Data Center 7A06-093 August 14, 2006 THE CITY OF NEW YORK OFFICE OF THE COMPTROLLER 1 CENTRE STREET NEW YORK, N.Y. 10007-2341 WILLIAM C. THOMPSON, JR.
More informationFEDERAL INFORMATION SECURITY. Mixed Progress in Implementing Program Components; Improved Metrics Needed to Measure Effectiveness
United States Government Accountability Office Report to Congressional Committees September 2013 FEDERAL INFORMATION SECURITY Mixed Progress in Implementing Program Components; Improved Metrics Needed
More informationAudit of the Department of State Information Security Program
UNITED STATES DEPARTMENT OF STATE AND THE BROADCASTING BOARD OF GOVERNORS OFFICE OF INSPECTOR GENERAL AUD-IT-15-17 Office of Audits October 2014 Audit of the Department of State Information Security Program
More informationEvaluation of DHS' Information Security Program for Fiscal Year 2014
Evaluation of DHS' Information Security Program for Fiscal Year 2014 December 12, 2014 HIGHLIGHTS Evaluation of DHS Information Security Program for Fiscal Year 2014 December 12, 2014 Why We Did This We
More information