Where To Report Waste

Fraud, Abuse, Or Retaliation

DOI’s CDM Program Not Capable of Providing Complete Information for Enterprise Risk Determinations

Submitting OIG:

Department of the Interior OIG

Date Issued:

Friday, September 30, 2016

Agency Reviewed / Investigated:

Department of the Interior

Submitting OIG-Specific Report Number:

ISD-IN-MOA-0004-2014-I

Component, if applicable:

Department-wide

Departmentwide

Location(s):

Agency-Wide

Type of Report:

Inspection / Evaluation

Questioned Costs:

$0

Funds for Better Use:

$0

Number of Recommendations:

6

View Document:

Attachment	Size
FinalEval_DOI%27sCDMProgram_101916_RevisedRedacted.pdf	3.55 MB

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation	Additional Details
ISD-IN-MOA-0004-2014-I-04	Open	No
We recommend that DOI’s Chief Information Officer incorporate and enforce the following items into its newly evolving vulnerability management program— a. enterprise-level monitoring and reporting of all devices and software packages; b. enterprise-level enforcement of consistent assessment, detection, prioritization and remediation techniques; c. required elevated account credential usage for testing; d. enterprise-level monitoring and bureau accountability for patch deployment; and e. enterprise-level quarantining for critically vulnerable systems that are not patched in a pre-defined timeframe.