FISCAL Year 2023 Federal Information Security Modernization Act Evaluation of AmeriCorps

Submitting OIG:

AmeriCorps, Office of Inspector General

Date Issued:

Friday, September 29, 2023

Agency Reviewed / Investigated:

AmeriCorps

Submitting OIG-Specific Report Number:

OIG-EV-23-08

Location(s):

Agency-Wide

Type of Report:

Inspection / Evaluation

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
OIG-Final-Report-FY-2023-FISMA-Evaluation-AmeriCorps-OIG-EV-23-08.pdf	2.39 MB

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	Yes
Update AmeriCorps' Information System Inventory to include external vendor systems such as Administrative Resource Center Financial System. (New)
2	Open	Yes
Establish policies and procedures to perform an annual review of the inventory to ensure AmeriCorps' Information System Inventory includes all information systems used or operated by an agency, an agency contractor, or another organization on behalf of an agency. (New)
3	Open	Yes
Upgrade to a supported version of the application software and revise the references to the supported software in the Business Impact Analysis or accept the risk of not updating the software by documenting the exposure risk in a formal risk acceptance memo signed by the Authorizing Official. (New)
4	Open	Yes
Develop and implement an effective monitoring mechanism to track the progress of Authorization to Operate letters within the three-year review window and ensure timely approval of the System Security Plans. (New)
5	Open	Yes
Complete an authorization package that covers the Administrative Resource Center Financial System (New)
6	Open	Yes
Enhance and implement core and specialized training to develop competencies in authorization packages for external vendor systems such as Administrative Resource Center Financial System. (New)
7	Open	Yes
Finalize and issue the Incident Response Plan for FY 2023. (New)
8	Open	Yes
Establish and implement a process and an effective monitoring mechanism to track the progress of Incident Response Plan annual reviews ensuring timely completion and updates, adapting the evolving cybersecurity threats, maintaining effective response capabilities, and reflecting the current agency operations and system environment. (New)
9	Open	Yes
Develop a comprehensive project plan and roadmap to meet the logging requirements in accordance with OMB M-21-31. (New)
10	Open	Yes
Upgrade and configure its Security Information and Event Management tool to capture all log requirements in accordance with OMB M-21-31. (New)

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Yes

Update AmeriCorps' Information System Inventory to include external vendor systems such as Administrative Resource Center Financial System. (New)

Open

Yes

Establish policies and procedures to perform an annual review of the inventory to ensure AmeriCorps' Information System Inventory includes all information systems used or operated by an agency, an agency contractor, or another organization on behalf of an agency. (New)

Open

Yes