Where To Report Waste

Fraud, Abuse, Or Retaliation

National Institutes of Health Grant Program Cybersecurity Requirements Need Improvement

Submitting OIG:

Department of Health & Human Services OIG

Date Issued:

Monday, September 19, 2022

Agency Reviewed / Investigated:

Department of Health & Human Services

Submitting OIG-Specific Report Number:

A-18-20-06300

Component, if applicable:

National Institutes of Health

National Institutes of Health

Location(s):

MD,

United States

Type of Report:

Audit

Questioned Costs:

$0

Funds for Better Use:

$0

Number of Recommendations:

5

View Document:

Attachment	Size
182006300.pdf	913.3 KB

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation	Additional Details
22-A-18-099.01	Open	No
CLA recommends that the National Institutes of Health management implement the recommendations below to enhance cybersecurity controls over its grant program. 1. Assess its grant award programs to determine which grants should require additional cybersecurity protections due to research potentially including sensitive and confidential data or NIH intellectual property or both.
22-A-18-099.02	Open	No
2. Based on results of NIH's risk assessment of grant applicants, include in the funding opportunity announcements or grant terms and conditions or both the cybersecurity controls that should be implemented.
22-A-18-099.03	Open	No
3. Strengthen the NIHGPS to establish clear and measurable standards for cybersecurity protections.
22-A-18-099.04	Open	No
4. Strengthen its pre-award process to identify and address how cybersecurity risk will be assessed.
22-A-18-099.05	Open	No
5. Strengthen its post-award process to confirm that cybersecurity protections have been implemented to adequately safeguard sensitive and confidential data.