National Credit Union Administration Federal Information Security Modernization Act of 2014 Audit—Fiscal Year 2022

Submitting OIG:

National Credit Union Administration OIG

Report Description:

This report summarizes the results of CLA’s independent evaluation and contains four recommendations that will assist the agency in improving the effectiveness of its information security and its privacy programs and practices. NCUA management concurred with and has planned corrective actions to address the recommendations.

Short / Alternative Report Title:

FY 2022 Independent Audit of the NCUA's Compliance with FISMA 2014

Date Issued:

Wednesday, October 26, 2022

Agency Reviewed / Investigated:

National Credit Union Administration

Submitting OIG-Specific Report Number:

OIG-22-07

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
OIG-22-07-NCUA-Federal-Information-Security-Modernization-Act-2014-Audit-FY2022Redacted508.pdf	2.76 MB

Additional Details Link:

https://www.ncua.gov/files/audit-reports/oig-audit-compliance-fisma-2022.pdf

Recommendation Number	Recommendation Status	Significant Recommendation	Additional Details
1. OIG-22-07 Recommendation	Open	No	National Credit Union Administration Federal Information Security Modernization Act of 2014 Audit—Fiscal Year 2022
Enforce the process to validate that expired MOUs and those expiring are prioritized for review, update, and renewal in accordance with NCUA policy.
2. OIG-22-07 Recommendation	Open	No	National Credit Union Administration Federal Information Security Modernization Act of 2014 Audit—Fiscal Year 2022
Conduct a workload analysis within OCIO and document a staffing plan to allocate appropriate and sufficient resources to improve OCIO’s ability to perform remediation of persistent vulnerabilities caused by missing patches, configuration weaknesses, and outdated software.
3. OIG-22-07 Recommendation	Open	No	National Credit Union Administration Federal Information Security Modernization Act of 2014 Audit—Fiscal Year 2022
Conduct an analysis of the technologies employed within the NCUA operational environment and document a plan to reduce the wide variety of differing technologies requiring support and vulnerability remediation, as feasible.
4. OIG-22-07 Recommendation	Open	No	National Credit Union Administration Federal Information Security Modernization Act of 2014 Audit—Fiscal Year 2022
Implement a solution that resolves the privileged access management vulnerability.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

1. OIG-22-07 Recommendation

Open

National Credit Union Administration Federal Information Security Modernization Act of 2014 Audit—Fiscal Year 2022

Enforce the process to validate that expired MOUs and those expiring are prioritized for review, update, and renewal in accordance with NCUA policy.

2. OIG-22-07 Recommendation

Open

National Credit Union Administration Federal Information Security Modernization Act of 2014 Audit—Fiscal Year 2022

Conduct a workload analysis within OCIO and document a staffing plan to allocate appropriate and sufficient resources to improve OCIO’s ability to perform remediation of persistent vulnerabilities caused by missing patches, configuration weaknesses, and outdated software.