Actions Have Been Taken to Improve the Privacy Program; However, Some Privacy Controls Have Not Been Fully Implemented and Assessed

Submitting OIG:

Date Issued:

Wednesday, June 14, 2023

Agency Reviewed / Investigated:

Submitting OIG-Specific Report Number:

2023-20-034

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
202320034fr.pdf	1.09 MB

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation
2	Open	No
Prioritize the implementation of the remaining NIST, SP 800-53, Revision 5, privacy controls not assessed in FISMA Year 2022 to ensure adherence to Federal requirements.
3	Open	No
Ensure that all assessed privacy control results are correctly applied to all fields in the new assessment and monitoring system and captured in the SSPs.
4	Open	No
The Chief Privacy Officer should ensure that privacy controls for cloud systems are implemented within one year from when updated FedRAMP guidance is approved and released. However, if this is not feasible, the privacy controls should be implemented following the current established continuous monitoring testing plan.