Evaluation of the CPSC's FISMA Implementation for FY 2024

Submitting OIG:

Report Description:

The U.S. Consumer Product Safety Commission (CPSC) OIG retained Williams, Adley, & Co.-DC LLP (Williams Adley, we), an independent public accounting firm, to perform the independent evaluation of the CPSC’s implementation of FISMA for FY 2024 and to determine the effectiveness of its information security program. This report documents the results of the OIG’s FISMA evaluation. Specifically, we assessed the CPSC’s compliance with the annual Inspector General (IG) FISMA reporting metrics set forth by the DHS and OMB. Agency efforts are scored against a five level maturity model ranging from level one, “ad hoc,” to level five, “optimized,” with level four, “managed and measurable,” generally considered effective.

Date Issued:

Tuesday, July 30, 2024

Agency Reviewed / Investigated:

Consumer Product Safety Commission

Submitting OIG-Specific Report Number:

24-A-04

Location(s):

Agency-Wide

Type of Report:

Inspection / Evaluation

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
Evaluation-CPSCs-FISMA-Implementation-FY-2024.pdf	1.53 MB

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	No
Define and document the taxonomy of the CPSC’s information system components, and classify each information system component as, at minimum, one of the following types: information technology system (e.g., proprietary and/or owned by the CPSC), application (e.g., commercial off-the-shelf, government off-the-shelf, or custom software), laptops and/or personal computers, service (e.g., external services that support the CPSC’s operational mission, facility, or social media).
2	Open	No
Identify and implement a Network Access Control solution that establishes set policies for hardware and software access on the agency’s network.
3	Open	No
Develop and implement a formal strategy to address information security risk management requirements as prescribed by the NIST guidance.
4	Open	No
Complete an assessment of information security risks related to the identified deficiencies and document a corresponding priority listing to address identified information security deficiencies and their associated recommendations. A corrective action plan should be developed that documents the priorities and timing requirements to address these deficiencies.
5	Open	No
Develop and implement an Enterprise Risk Management program based on NIST, Chief Financial Officers Council and Performance Improvement Council Enterprise Risk Management Playbook, and OMB Circular A-123, Section II guidance. This includes establishing a cross-departmental risk executive (function) led by senior management to provide both a departmental and organization level view of risk to the top decision makers within the CPSC.
6	Open	No
Develop, document, and implement a process for determining and defining system boundaries in accordance with NIST guidance.
7	Open	No
Develop and implement an information security architecture that supports the enterprise architecture.
8	Open	No
Develop an enterprise architecture to be integrated into the risk management process.
9	Open	No
Implement solutions to perform scenario analysis and model potential responses, including modeling the potential impact of a threat exploiting a vulnerability and the resulting impact to organizational systems and data.
10	Open	No
Implement registration and inventorying procedures for the CPSC’s information systems.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Define and document the taxonomy of the CPSC’s information system components, and classify each information system component as, at minimum, one of the following types: information technology system (e.g., proprietary and/or owned by the CPSC), application (e.g., commercial off-the-shelf, government off-the-shelf, or custom software), laptops and/or personal computers, service (e.g., external services that support the CPSC’s operational mission, facility, or social media).

Open

Identify and implement a Network Access Control solution that establishes set policies for hardware and software access on the agency’s network.

Open

Develop and implement a formal strategy to address information security risk management requirements as prescribed by the NIST guidance.

Open

Complete an assessment of information security risks related to the identified deficiencies and document a corresponding priority listing to address identified information security deficiencies and their associated recommendations. A corrective action plan should be developed that documents the priorities and timing requirements to address these deficiencies.