Audit of the U.S. Office of Personnel Management’s Fiscal Year 2021 Consolidated Financial Statements

Submitting OIG:

Office of Personnel Management OIG

Date Issued:

Friday, November 12, 2021

Agency Reviewed / Investigated:

Office of Personnel Management

Submitting OIG-Specific Report Number:

4A-CF-00-21-027

Component, if applicable:

Other

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

View Document:

Attachment	Size
4A-CF-00-21-027.pdf	359.06 KB

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	No
Review and update system documentation (System Security Plans and Authority to Operate Packages) and appropriately document results of Risk Assessments and Information System Continuous Monitoring) in accordance with agency policies and procedures.
2	Open	No
Enhance processes in place to track the inventory of OPM's systems and devices and validate that security software and tools are installed on all systems.
3	Open	No
Implement a system or control that tracks current and separated OPM contractors.
4	Open	No
Assign specific individuals with overseeing and monitoring POA&Ms to ensure security weaknesses correspond to a POA&M and are remediated in a timely manner.
5	Open	No
Establish a means of documenting a list of users with significant information system responsibilities to ensure the listing is complete and accurate and the appropriate training is completed.
8	Open	No
Ensure policies and procedures governing the provisioning and de-provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.
9	Open	No
Perform a comprehensive periodic review of the appropriateness of personnel with access to systems.
10	Open	No
Implement two-factor authentication for applications.
11	Open	No
Document access rights to systems to include roles, role descriptions, privileges or activities associated with each role and role or activity assignments that may cause a segregation of duties conflict.
12	Open	No
Prepare audit logging and monitoring procedures for databases within application boundaries. Review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow up or elevation of issues to the appropriate team members for review. The review of audit logs should be documented for record retention purposes.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Review and update system documentation (System Security Plans and Authority to Operate Packages) and appropriately document results of Risk Assessments and Information System Continuous Monitoring) in accordance with agency policies and procedures.

Open

Enhance processes in place to track the inventory of OPM's systems and devices and validate that security software and tools are installed on all systems.

Open

Implement a system or control that tracks current and separated OPM contractors.

Open

Assign specific individuals with overseeing and monitoring POA&Ms to ensure security weaknesses correspond to a POA&M and are remediated in a timely manner.