Evaluation of the CPSC's FISMA Implementation for FY 2022

Submitting OIG:

Consumer Product Safety Commission OIG

Date Issued:

Friday, July 22, 2022

Agency Reviewed / Investigated:

Consumer Product Safety Commission

Submitting OIG-Specific Report Number:

22-A-06

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

View Document:

Attachment	Size
Evaluation-CPSCs-FISMA-Implementation-FY2022-Final.pdf	1.42 MB

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	Yes
Implement registration and inventorying procedures for the CPSC’s information systems. (2022 Recommendation).
2	Open	No
Develop, document, and implement a process for determining and defining system boundaries in accordance with National Institute of Standards and Technology guidance (2020 Recommendation).
3	Open	No
Establish and implement a policy and procedures to manage software licenses using automated monitoring and expiration notifications (2020 Recommendation).
4	Open	Yes
Establish and implement a policy and procedure to ensure that only authorized hardware and software execute on the agency’s network (2020 Recommendation).
5	Open	No
Define and document the taxonomy of the CPSC’s information system components, and classify each information system component as, at minimum, one of the following types: information technology system (e.g., proprietary and/or owned by the CPSC), application (e.g., commercial off-the-shelf, government off-the-shelf, or custom software), laptops and/or personal computers, service (e.g., external services that support the CPSC’s operational mission, facility, or social media) (2020 Recommendation)
6	Open	Yes
Identify and implement a Network Access Control solution that establishes set policies for hardware and software access on the agency’s network (2020 Recommendation).
7	Open	Yes
Develop and implement a formal strategy to address information security risk management requirements as prescribed by the National Institute of Standards and Technology guidance (2020 Recommendation).
8	Open	Yes
Complete an assessment of information security risks related to the identified deficiencies and document a corresponding priority listing to address identified information security deficiencies and their associated recommendations. A corrective action plan should be developed that documents the priorities and timing requirements to address these deficiencies (2020 Recommendation).
9	Open	Yes
Develop and implement an Enterprise Risk Management (ERM) program based on National Institute of Standards and Technology and ERM Playbook (OMB Circular A-123, Section II requirement) guidance. This includes establishing a cross-departmental risk executive (function) lead by senior management to provide both a departmental and organization level view of risk to the top decision makers within the CPSC (2020 Recommendation).
10	Open	No
Implement solutions to perform scenario analysis and model potential responses, including modeling the potential impact of a threat exploiting a vulnerability and the resulting impact to organizational systems and data (2022 Recommendation).

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Yes

Implement registration and inventorying procedures for the CPSC’s information systems. (2022 Recommendation).

Open

Develop, document, and implement a process for determining and defining system boundaries in accordance with National Institute of Standards and Technology guidance (2020 Recommendation).

Open

Establish and implement a policy and procedures to manage software licenses using automated monitoring and expiration notifications (2020 Recommendation).

Open