We recommend that IAF’s chief information officer update the agency’s system security plan to include controls in National Institute of Standards and Technology Special Publication 800-53, Revision 5, “Security and Privacy Controls for Information Systems and Organizations.”