Audit of the U.S. Election Assistance Commission's Compliance with the Federal Information Security Modernization Act for Fiscal Year 2024

Submitting OIG:

Report Description:

The independent public accounting firm of RMA Associates, LLC, under contract with the Office of Inspector General, audited EAC’s information security program for fiscal year 2024 in support of the Federal Information Security Modernization Act of 2014 (FISMA). The objective was to determine whether EAC implemented an effective information security program.

Date Issued:

Tuesday, September 24, 2024

Agency Reviewed / Investigated:

Election Assistance Commission

Submitting OIG-Specific Report Number:

P24HQ0052-24-15

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
P24HQ0052-24-15-EAC-FY24-FISMA-Audit.pdf	1.84 MB

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	No
We recommend that the Chief Information Security Officer identify qualitative and quantitative metrics on service level agreements held with third parties, then perform an analysis with monthly reporting received from those third parties to identify metrics that can be measured and documented, on either a monthly or quarterly basis, to ensure that EAC is receiving all contracted services.
2	Open	No
We recommend that the Chief Information Security Officer develop and implement procedures to leverage the Repository for Software Attestation and Artifacts to obtain sufficient assurance that the security and supply chain controls of systems or services provided by contractors or other entities on behalf of the organization meet FISMA requirements.
3	Open	No
We recommend that the Chief Information Security Officer provide annual Anti-Counterfeit Training for IT staff with SCRM responsibilities.
4	Open	No
We recommend that the Election Assistance Commission's Chief Information Officer implement EL3 logging requirements in accordance with Office of Management and Budget memorandum M-21-31.
6	Open	No
We recommend that the Election Assistance Commission's Chief Information Officer establish and implement a formal Information Security Continuous Monitoring Strategy and an effective monitoring mechanism to track the progress of ongoing lessons learned.
7	Open	No
We recommend that the Election Assistance Commission's Chief Information Officer identify and employ an automated notification mechanism to test its system level contingency plans thoroughly and effectively.

Election Assistance Commission OIG

Election Assistance Commission

The Office of Inspector General (OIG) is an independent division of the U.S. Election Assistance Commission (EAC). The OIG was created in 2005 and operates under the authorities vested in it by the Help America Vote Act (HAVA) and the Inspector General Act of 1978, as amended. The mission of the OIG is to enhance the economy, efficiency, and effectiveness of EAC’s operations by: conducting audits, reviews, evaluations and assessments of EAC programs and operations; detecting and preventing fraud, waste, abuse and mismanagement of EAC programs; promoting better EAC management; preserving and protecting EAC employee and program integrity; and communicating with the Commission and Congress to keep them fully informed of the status of EAC administration and operations and the need for and progress of corrective actions.

https://oig.eac.gov/

Search form

Audit of the U.S. Election Assistance Commission's Compliance with the Federal Information Security Modernization Act for Fiscal Year 2024

Related Open Recommendations