FY 2021 FISMA DOL Information Security Report: Information Security Continuous Monitoring Controls Remain Deficient

Submitting OIG:

Date Issued:

Friday, January 28, 2022

Agency Reviewed / Investigated:

Submitting OIG-Specific Report Number:

23-22-001-07-725

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

View Document:

Attachment	Size
23-22-001-07-725FY-2021-FISMAFinal-Rpt01282022.pdf	1013.9 KB

Additional Details Link:

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation
4	Open	Yes
We recommend the CIO: Enforce DOL requirements for implementing, auditing, testing and documenting exceptions to baseline configurations.
7	Open	Yes
We recommend the CIO: Execute the OCIO and AO oversight process to ensure compliance with DOL requirements for the performance of Security Impact Analysis (SIA)s prior to the implementation of system changes.
8	Open	Yes
We recommend the CIO: Implement a centralized process to monitor vulnerabilities for information systems to ensure that each vulnerability is remediated within the Computer Security Handbook (CSH) defined timeframe.
13	Open	Yes
We recommend the CIO: Develop clear standards for the documentation of information security controls and enforce the adherence to these standards through OCIO monitoring processes for developing, reviewing and maintaining system security plans and documentation.
18	Open	Yes
We recommend the CIO: Enhance the OCIO monitoring and oversight of system owners to complete BIAs.