We recommend that the Chief Information Officer require the Department to correct or mitigate the vulnerabilities identified during the security assessment, in accordance with the severity level of each vulnerability identified.