Audit of the Federal Housing Finance Agency’s Information Security Programs and Practices Fiscal Year 2024

Submitting OIG:

Federal Housing Finance Agency OIG

Date Issued:

Tuesday, July 30, 2024

Agency Reviewed / Investigated:

Federal Housing Finance Agency

Submitting OIG-Specific Report Number:

AUD-2024-006

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
AUD-2024-006.pdf	950.89 KB

Recommendation Number	Recommendation Status	Significant Recommendation
AUD-2024-006-1	Open	No
FHFA should develop and implement policies and procedures to oversee FHFA’s background reinvestigation process, including oversight controls over FHFA’s service provider.
AUD-2024-006-2	Open	No
FHFA should update the service level agreement between FHFA and the service provider to include requirements for the service provider to provide background reinvestigation status reports on a regular basis.
AUD-2024-006-3	Open	No
FHFA should implement a process to monitor and ensure that background reinvestigations for relevant employees and contractors are conducted timely in accordance with FHFA and OPM standards.
AUD-2024-006-4	Open	No
FHFA-OIG's Chief Information Officer should develop and implement policies and procedures to oversee FHFA-OIG’s background reinvestigation process, including oversight controls over FHFA-OIG’s service provider.
AUD-2024-006-5	Open	No
FHFA-OIG's Chief Information Officer should update the service level agreement between FHFA-OIG and the service provider to include requirements for the service provider to provide background reinvestigation status reports on a regular basis.
AUD-2024-006-6	Open	No
FHFA-OIG's Chief Information Officer should implement a process to monitor and ensure that background reinvestigations for relevant employees and contractors are conducted timely in accordance with FHFA-OIG and OPM standards.
AUD-2024-006-7	Open	No
FHFA-OIG's Chief Information Officer should establish and implement a process to make suitability adjudicative determinations and take suitability actions for covered positions in accordance with OPM’s regulation under Title 5 CFR, Part 731.103.
AUD-2024-006-8	Open	No
FHFA should disable accounts of nonprivileged users who have been inactive for over 365 days, as required by the FHFA customer controls for the cloud system.
AUD-2024-006-9	Open	No
FHFA should work with the cloud system’s vendor to implement software updates that automatically disable user accounts after 365 days of inactivity, as required by the FHFA customer controls for the cloud system.
AUD-2024-006-10	Open	No
FHFA should update the customer controls for the cloud system to include a procedure for regular reviews of non-privileged users’ access.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

AUD-2024-006-1

Open

FHFA should develop and implement policies and procedures to oversee FHFA’s background reinvestigation process, including oversight controls over FHFA’s service provider.

AUD-2024-006-2

Open

FHFA should update the service level agreement between FHFA and the service provider to include requirements for the service provider to provide background reinvestigation status reports on a regular basis.

AUD-2024-006-3

Open