Review of the Department of Health and Human Services' Compliance with the Federal Information Security Modernization Act of 2014 for Fiscal Year 2021

Submitting OIG:

Department of Health & Human Services OIG

Date Issued:

Monday, April 25, 2022

Agency Reviewed / Investigated:

Department of Health & Human Services

Submitting OIG-Specific Report Number:

A-18-21-11200

Component, if applicable:

Office of the Secretary

Location(s):

DC,

United States

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

View Document:

Attachment	Size
182111200.pdf	32.91 MB

Recommendation Number	Recommendation Status	Significant Recommendation
22-A-18-053.01	Open	No
Continue implementation of an automated CDM solution that provides a centralized, enterprise-wide view of risks across all of HHS.
22-A-18-053.02	Open	No
Update the ISCM strategy to include a more specific roadmap; including target dates, for ISCM deployment across the HHS enterprise.
22-A-18-053.03	Open	No
HHS should perform an enterprise risk assessment over known control weaknesses (e.g., Authority to Operate, incomplete OpDiv provided system inventories, lack of OpDiv adherence to HHS information security policies) due to their federated environment and document an appropriate risk response (e.g., accept, avoid, mitigate, share, or transfer).
22-A-18-053.04	Open	No
Develop a process to monitor information system contingency plans to ensure they are developed, maintained, and integrated with other continuity requirements by information systems.
22-A-18-053.05	Open	No
HHS OCIO work with all OpDivs to: Ensure that all operational systems have SSPs and FIPS 199 categorizations completed for information systems in accordance with HHS policy.
22-A-18-053.06	Open	No
HHS OCIO work with all OpDivs to: Ensure that all OpDivs are completing security controls system assessments and POA&Ms at least quarterly or more frequently as defined by the OpDiv.
22-A-18-053.07	Open	No
HHS OCIO work with all OpDivs to: Ensure that baseline configuration requirements are implemented and maintained across all systems within its environment. Additionally, ensure that system owners implement procedures to document and retain evidence of current baseline configurations.
22-A-18-053.08	Open	No
HHS OCIO work with all OpDiv to: Ensure that all systems implement processes to track system changes throughout the change management process, to include testing, validation, and documentation. Additionally, procedures should be implemented to retain evidence of all changes.
22-A-18-053.09	Open	No
HHS OCIO work with all OpDivs to: Develop a management approved Configuration Management policy that addresses purpose, scope, roles, responsibilities, management commitment and coordination among organizational entities. This document should be tailored to the OpDivs' needs and be reviewed and updated according to HHS policy (at least every 3 years).
22-A-18-053.10	Open	No
HHS OCIO work with the OpDivs to ensure that all DpDivs: Update and implement its personnel security policies to clearly articulate the personnel screening process along with the required access agreements that need to be completed prior to being granted system access. In addition, OpDivs should update and implement their procedures for retrieving and archiving user access agreements for internal control purposes.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

22-A-18-053.01

Open

Continue implementation of an automated CDM solution that provides a centralized, enterprise-wide view of risks across all of HHS.

22-A-18-053.02

Open

Update the ISCM strategy to include a more specific roadmap; including target dates, for ISCM deployment across the HHS enterprise.

22-A-18-053.03

Open