Stay Informed
of New Reports
Twitter
Where To Report Waste
Fraud, Abuse, Or Retaliation
Where To Report Waste Fraud, Abuse, Or Retaliation

Audit of the DoD’s Compliance with Security Requirements When Using Commercial Cloud Services

Submitting OIG: 
Department of Defense OIG
Date Issued: 
Wednesday, February 15, 2023
Agency Reviewed / Investigated: 
Department of Defense
Submitting OIG-Specific Report Number: 
DODIG-2023-052
Component, if applicable: 
OSD Chief Information Officer (CIO)
United States Air Force (USAF)
United States Army (USA)
United States Marine Corps (USMC)
United States Navy (USN)
Location(s): 
Agency-Wide
Type of Report: 
Audit
Questioned Costs: 
$0
Funds for Better Use: 
$0
Number of Recommendations: 
5
View Document: 
AttachmentSize
PDF icon DODIG-2023-052.pdf13.45 MB

Related Open Recommendations

Recommendation Number Recommendation Status Significant Recommendation Additional Details
D-2023-0052-D000CP-0001-0001 Open No
Rec. 1: The DoD OIG recommended that the Chief Information Officer for the Army require the authorizing official for the DoD Explosives Safety Knowledge Enterprise System to reevaluate the authorization to operate, including a review of all required documentation to consider the risks associated with using the authorized commercial cloud service offering, such as the documentation supporting the Federal Risk and Authorization Management Program and the DoD authorization processes and the continuous monitoring activities, as required by the DoD Cloud Computing Security Requirements Guide.
D-2023-0052-D000CP-0001-0002.a Open No
Rec. 2.a: The DoD OIG recommended that the Department of the Navy Chief Information Officer require that the authorizing official for the Navy Enterprise Resource Planning system, in coordination with the Department of the Navy Deputy Chief Information Officer for the Navy, reevaluate the authorization to operate, including a review of all required documentation to consider the risks associated with using the authorized commercial cloud service offering, such as the documentation supporting the Federal Risk and Authorization Management Program and the DoD authorization processes and continuous monitoring activities, as required by the DoD Cloud Computing Security Requirements Guide.
D-2023-0052-D000CP-0001-0002.b Open No
Rec. 2.b: The DoD OIG recommended that the Department of the Navy Chief Information Officer require that the authorizing official for the MarineNet system, in coordination with the Department of the Navy Deputy Chief Information Officer for the Marine Corps, reevaluate the authorization to operate, including a review of all required documentation to consider the risks associated with using the authorized commercial cloud service offering, such as the documentation supporting the Federal Risk and Authorization Management Program and the DoD authorization processes and continuous monitoring activities, as required by the DoD Cloud Computing Security Requirements Guide.
D-2023-0052-D000CP-0001-0003 Open No
Rec. 3: The DoD OIG recommended that the Chief Information Officer for the Air Force require that the authorizing officials for the Tailored Multitenancy Integrated Service and Cloud One systems reevaluate the authorizations to operate, including a review of all required documentation to consider the risks associated with using the authorized commercial cloud service offering, such as the documentation supporting the Federal Risk and Authorization Management Program and DoD authorization processed and continuous monitoring activities, as required by the DoD Cloud Computing Security Requirements Guide.
D-2023-0052-D000CP-0001-0004 Open No
Rec. 4: The DoD OIG recommended that the DoD Chief Information Officer emphasize the importance of following the DoD Cloud Computing Requirements Guide when using commercial cloud service offerings, and reviewing all required documentation to consider the commercial cloud service offering's risks before granting and when maintaining system-level authorizations to operate, which should be documented as part of the authorization to operate process.
D-2023-0052-D000CP-0001-0005 Open No
Recommendation is CUI
Displaying 6 of 6 Recommendations