U.S. Department of Agriculture, Office of the Chief Information Officer, Fiscal Year 2023 Federal Information Security Modernization Act

Submitting OIG:

Department of Agriculture OIG

Report Description:

As required by the Federal Information Security Modernization Act, OIG reviewed USDA's ongoing efforts to improve its information technology security program and practices during Fiscal Year 2023.

Date Issued:

Friday, July 28, 2023

Agency Reviewed / Investigated:

Department of Agriculture

Submitting OIG-Specific Report Number:

50503-0011-12

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
50503-0011-12FR508FOIAredactedpublicsigned.pdf	2.09 MB

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	Yes
OCIO management should improve internal processes so that internal ATO reviews are completed on time, prior to the existing ATOs expiring.
2	Open	Yes
OCIO management should improve oversight over contractors and enforce the timely completion of ATOs, in accordance with USDA policy.
3	Open	Yes
OCIO management should update existing policy and procedures to define the conditions under which temporary reauthorization decisions may be granted (i.e., systems scheduled for retirement and disposal).
4	Open	Yes
Rural Development management should improve system owner and support staff communications with OCIO regarding system retirements and disposals to ensure their information systems remain authorized until system disposal is completed.
5	Open	Yes
OCIO management should design and implement a quality control process to validate that designated management are incorporating and complying with the requirements of DR 3505-003.
6	Open	Yes
OCIO management should design and implement a process to ensure access control documentation, such as application user listings with the required data elements (i.e., account creation and recertification dates), is retained to support its system of internal controls and operational needs as required by GAO standards.
7	Open	Yes
Food Safety and Inspection Service management should implement a standardized process to conduct and monitor reviews of privileged application accounts to ensure appropriate access rights.
8	Open	Yes
Food Safety and Inspection Service management should implement a standardized process for the system teams to conduct, monitor, and maintain user access request forms prior to granting system access.
9	Open	Yes
Research, Education, and Economics management should implement a standardized process for the system teams to conduct, monitor, and maintain user access request forms prior to granting system access.
10	Open	Yes
Rural Development management should implement a standardized process for the system teams to conduct, monitor, and maintain user access request forms prior to granting system access.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Yes

OCIO management should improve internal processes so that internal ATO reviews are completed on time, prior to the existing ATOs expiring.

Open

Yes

OCIO management should improve oversight over contractors and enforce the timely completion of ATOs, in accordance with USDA policy.

Open

Yes