FISMA: Despite Weaknesses, USADF Generally Implemented an Effective Information Security Program for Fiscal Year 2024

Submitting OIG:

U.S. Agency for International Development OIG

Date Issued:

Thursday, August 29, 2024

Agency Reviewed / Investigated:

U.S. African Development Foundation

Submitting OIG-Specific Report Number:

A-ADF-24-003-C

Location(s):

United States

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
ADF-24-003-C.pdf	1.1 MB

Recommendation Number	Recommendation Status	Significant Recommendation	Additional Details
1	Open
Chief Information Officer develop and implement procedures to assess whether position risk designations are reviewed for all personnel._x000D_ _x000D_
2	Open
Chief Information Officer develop and implement procedures to assess whether reinvestigations are performed timely for individuals who possess critical-sensitive/high-risk roles that require system access._x000D_ _x000D_
3	Open
Chief Information Officer develop and implement policies and procedures to periodically assess its cybersecurity workforce’s knowledge, skills, and abilities to confirm that security training and development activities align with agency needs.
4	Open
Chief Information Officer develop and implement policies and procedures for agency personnel to monitor performance metrics for information technology services provided by third parties.
5	Open
Chief Information Officer update the change management charter to designate in writing the responsibilities for monitoring performance metrics, conducting lessons-learned activities, and documenting routine updates and minor changes._x000D_ _x000D_
6	Open
Chief Information Officer update the system security plan to include the frequency for reviewing and updating the contingency plan.
7	Open
Chief Information Officer develop and implement policies and procedures to obtain feedback on the agency’s specialized security training, update the training program, and request that third-party providers update their training content, as appropriate, to keep current with security practices.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Chief Information Officer develop and implement procedures to assess whether position risk designations are reviewed for all personnel._x000D_ _x000D_

Open

Chief Information Officer develop and implement procedures to assess whether reinvestigations are performed timely for individuals who possess critical-sensitive/high-risk roles that require system access._x000D_ _x000D_

Open

Chief Information Officer develop and implement policies and procedures to periodically assess its cybersecurity workforce’s knowledge, skills, and abilities to confirm that security training and development activities align with agency needs.

Open

Chief Information Officer develop and implement policies and procedures for agency personnel to monitor performance metrics for information technology services provided by third parties.