Evaluation of the CPSC's Management of Cloud Computing, Shared Services, & Third-Party Systems

Submitting OIG:

Report Description:

We retained the services of Williams, Adley, & Co.-DC LLP (Williams Adley), an independent public accounting firm, to conduct an evaluation to assess the Consumer Product Safety Commission’s (CPSC) management of its cloud systems, shared services, and third-party systems, from a legal, internal control, and contractual perspective.

Date Issued:

Wednesday, January 31, 2024

Agency Reviewed / Investigated:

Consumer Product Safety Commission

Submitting OIG-Specific Report Number:

24-A-01

Location(s):

Agency-Wide

Type of Report:

Inspection / Evaluation

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
Evaluation-CPSCs-Management-Cloud-Computing-Shared-Services-Third-Party-Systems.pdf	1.37 MB

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	Yes
Develop and implement an IT modernization plan. This plan should: i. document an inventory of all legacy systems in operation at the CPSC ii. identify the cost associated with the operations and maintenance of the legacy systems in operation in the current environment at the CPSC iii. identify the resources necessary to modernize each CPSC legacy system (e.g., migrating to a Commercial-Off-The-Shelf solution or shared services solution, moving to a cloud environment, etc.) iv. analyze potential opportunities to save money, improve operations, and improve security through modernizing the CPSC’s legacy systems
2	Open	No
Develop and establish a process to monitor the implementation of the IT modernization plan by documenting the objectives, goals, tasks, milestones, metrics, and funding sources associated with management’s modernization efforts.
3	Open	Yes
Establish and implement a policy and procedure to manage the cloud computing, shared services, and third-party system inventory necessary for transitioning to a consumptionbased service model.
4	Open	No
The CPSC should develop and implement policies and procedures to periodically review security packages from external service providers (such as those hosting cloud, shared services, and third-party systems) to ensure that the risks posed by the external service provider are within the CPSC’s risk appetite and tolerance.
5	Open	No
The CPSC should review the external service provider’s customer responsibility matrices, select, tailor, implement the relevant security controls from those matrices and then document (and periodically reassess) those controls to support the ongoing authorization to operate and use decision.
6	Open	No
The CPSC should revisit the scope section of its security assessment policies and procedures to ensure that they include appropriate consideration for third-party systems.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Yes

Develop and implement an IT modernization plan. This plan should: i. document an inventory of all legacy systems in operation at the CPSC ii. identify the cost associated with the operations and maintenance of the legacy systems in operation in the current environment at the CPSC iii. identify the resources necessary to modernize each CPSC legacy system (e.g., migrating to a Commercial-Off-The-Shelf solution or shared services solution, moving to a cloud environment, etc.) iv. analyze potential opportunities to save money, improve operations, and improve security through modernizing the CPSC’s legacy systems

Open

Develop and establish a process to monitor the implementation of the IT modernization plan by documenting the objectives, goals, tasks, milestones, metrics, and funding sources associated with management’s modernization efforts.

Open

Yes

Establish and implement a policy and procedure to manage the cloud computing, shared services, and third-party system inventory necessary for transitioning to a consumptionbased service model.