GSA Should Strengthen the Security of Its Robotic Process Automation Program

Submitting OIG:

General Services Administration OIG

Date Issued:

Tuesday, August 6, 2024

Agency Reviewed / Investigated:

General Services Administration

Submitting OIG-Specific Report Number:

A230020BTF24004

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
A230020-Final-Report-Redacted.pdf	715.05 KB

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	Yes
We recommend that GSA’s Chief Financial Officer and Chief Information Officer conduct a comprehensive assessment of GSA’s CIO-IT Security-19-97, IT Security Procedural Guide: Robotic Process Automation (RPA) Security, (RPA policy) to ensure, among other things, that its monitoring controls are effectively designed and implemented.
2	Open	Yes
We recommend that GSA’s Chief Financial Officer and Chief Information Officer develop oversight mechanisms to enforce compliance with the RPA policy and ensure that controls are operating effectively.
3	Open	Yes
We recommend that GSA’s Chief Financial Officer and Chief Information Officer require system security plans to be updated as part of the RPA security approval process to address bot and non-person entity access.
4	Open	Yes
We recommend that GSA’s Chief Financial Officer and Chief Information Officer review all system security plans that bots currently interact with to determine if they address bot and non-person entity access. Update the system security plans, as needed.
5	Open	Yes
We recommend that GSA’s Chief Financial Officer and Chief Information Officer establish procedures as part of the RPA security approval process that ensure system owners consider updating the security controls identified in Appendix A of the RPA policy.
6	Open	Yes
We recommend that GSA’s Chief Financial Officer and Chief Information Officer review all system security plans that bots currently interact with to determine if the security controls need to be updated. Update the system security plans, as needed.
7	Open	Yes
We recommend that GSA’s Chief Financial Officer and Chief Information Officer develop a comprehensive process for removing bot custodian and bot developer access for decommissioned bots and GSA systems that: aligns with GSA’s CIO-IT Security-01-07, IT Security Procedural Guide: Access Control (AC) (access control policy); tracks and documents that access has been removed; and incorporates the process into the RPA policy.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Yes

We recommend that GSA’s Chief Financial Officer and Chief Information Officer conduct a comprehensive assessment of GSA’s CIO-IT Security-19-97, IT Security Procedural Guide: Robotic Process Automation (RPA) Security, (RPA policy) to ensure, among other things, that its monitoring controls are effectively designed and implemented.

Open

Yes

We recommend that GSA’s Chief Financial Officer and Chief Information Officer develop oversight mechanisms to enforce compliance with the RPA policy and ensure that controls are operating effectively.

Open

Yes