Lack of Basic Security Practices Hindered BIS’ Continuous Monitoring Program and Placed Critical Systems at Risk

For our final report on the Bureau of Industry and Security's (BIS') continuous monitoring program, our objective -- in accordance with the Federal Information Security Management Act of 2002 -- was to determine whether BIS' continuous monitoring strategy and practices, including ongoing security control assessments of its critical information systems, provide adequate information for authorizing officials to make proper risk-based decisions.