The Department Mismanaged, Neglected, and Wasted Money on the Implementation of IT Security Requirements for Its National Security Systems

Submitting OIG:

Department of Commerce OIG

Report Description:

Our evaluation objective was to determine whether the Department and its bureaus are managing national security systems in compliance with federal and Departmental information technology security requirements. We found the following: I. The Department mismanaged and neglected information technology security requirements for its national security systems. II. The Department wasted at least $380,000 on a national security system that it did not use.

Short / Alternative Report Title:

The Department Mismanaged, Neglected, and Wasted Money on the Implementation of IT Security Requirements

Date Issued:

Wednesday, June 15, 2022

Agency Reviewed / Investigated:

Department of Commerce

Submitting OIG-Specific Report Number:

OIG-22-023-I

Component, if applicable:

Office of the Secretary

Location(s):

Agency-Wide

Type of Report:

Inspection / Evaluation

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

View Document:

Attachment	Size
OIG-22-023-I-REDACTED.pdf	679.21 KB

Additional Details Link:

https://www.oig.doc.gov/Pages/The-Department-Mismanaged-Neglected-and-Wasted-Mon…

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	Yes
We recommend that the Deputy Secretary of Commerce ensure that the Chief Information Officer implement the following Committee on National Security Systems and National Institute of Standards and Technology IT security requirements for System X: (a) fill fundamental security roles (e.g., system owner, information system security officer); (b) complete the risk management framework steps, including authorizing System X to operate; (c) develop a process to regularly install software security updates; and (d) replace end-of-life system components.
2	Open	Yes
We recommend that the Deputy Secretary of Commerce ensure that the Chief Information Officer implement multi-factor authentication for access to all of the Department's NSS according to Committee on National Security Systems requirements.
3	Open	Yes
We recommend that the Deputy Secretary of Commerce ensure that the Chief Information Officer define and convey which responsibilities OCIO will provide regarding a multi-factor authentication infrastructure.
4	Open	Yes
We recommend that the Deputy Secretary of Commerce ensure that the Chief Information Officer perform an organizational review to ensure all of the Department's NSS receive sufficient oversight and resources to conduct required security activities.
5	Open	Yes
We recommend that the Deputy Secretary of Commerce ensure that the Chief Information Officer immediately develop detailed policies and procedures that will do the following: (a) ensure the authorization process for Departmental NSS is clearly defined and executed according to the risk management framework; (b) require that Department NSS receive regular, independent assessments according to the risk management framework. These policies and procedures must include consideration of security clearance adjudication timeframes for future assessments; and (c) address the creation and maintenance of an NSS inventory. This should include a requirement for all Department bureaus to provide an update when changes occur.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Yes

We recommend that the Deputy Secretary of Commerce ensure that the Chief Information Officer implement the following Committee on National Security Systems and National Institute of Standards and Technology IT security requirements for System X: (a) fill fundamental security roles (e.g., system owner, information system security officer); (b) complete the risk management framework steps, including authorizing System X to operate; (c) develop a process to regularly install software security updates; and (d) replace end-of-life system components.

Open

Yes

We recommend that the Deputy Secretary of Commerce ensure that the Chief Information Officer implement multi-factor authentication for access to all of the Department's NSS according to Committee on National Security Systems requirements.

Open

Yes