Audit of the DoD’s Management of the Cybersecurity Risks for Government Purchase Card Purchases of Commercial Off-the-Shelf Items

Submitting OIG:

Department of Defense OIG

Date Issued:

Tuesday, July 30, 2019

Agency Reviewed / Investigated:

Department of Defense

Submitting OIG-Specific Report Number:

DODIG-2019-106

Component, if applicable:

OSD Chief Information Officer (CIO)

Under Secretary of Defense for Acquisition and Sustainment

United States Air Force (USAF)

United States Army (USA)

United States Navy (USN)

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

Yes

View Document:

Attachment	Size
DODIG-2019-106-SECTION-5274.pdf	9.71 MB

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation
D-2019-0106-D000CR-0001-0001.a	Open	No
Rec. 1.a: The DoD OIG recommended that the Secretary of Defense direct an organization or group to develop a risk-based approach to prioritize commercial off-the-shelf items for further evaluation.
D-2019-0106-D000CR-0001-0001.b	Open	No
Rec. 1.b: The DoD OIG recommended that the Secretary of Defense direct an organization or group to develop a process to test high-risk commercial off-the-shelf items.
D-2019-0106-D000CR-0001-0001.c	Open	No
Rec. 1.c: The DoD OIG recommended that the Secretary of Defense direct an organization or group to develop a process to prohibit the purchase and use of high-risk commercial off-the-shelf items, when necessary, until mitigation strategies can limit the risk to an acceptable level.
D-2019-0106-D000CR-0001-0002.a	Open	No
Rec. 2.a: The DoD OIG recommended that the Under Secretary of Defense for Acquisition and Sustainment update existing DoD acquisition policies or develop and implement new policy to require organizations to review and evaluate cybersecurity risks, including supply chain and counterintelligence risks, for high-risk commercial off-the-shelf items prior to purchase, regardless of purchase method.
D-2019-0106-D000CR-0001-0002.b	Open	No
Rec. 2.b: The DoD OIG recommended that the Under Secretary of Defense for Acquisition and Sustainment update Government purchase card program policy and training to include training on common cybersecurity risks, including supply chain and counterintelligence risks, for commercial off-the-shelf information technology items and the impact of the risks to the mission.
D-2019-0106-D000CR-0001-0003	Open	No
Rec. 3: The DoD OIG recommended that the DoD Chief Information Officer revise DoD Instruction 8100.04, "DoD Unified Capabilities (UC)," December 9, 2010, to require an assessment of supply chain risks as a condition for approval to be included on the Unified Capabilities approved products list.

Department of Defense OIG

Department of Defense

The Department of Defense Office of Inspector General was established in 1982. The mission of the DoD OIG, as established by the Inspector General Act of 1978, as amended, (5 U.S.C. Appendix); and implemented by DoD Directive 5106.01, "Inspector General of the Department of Defense," is to serve as an independent and objective office in DoD to:

a) conduct, supervise, monitor, and initiate audits, evaluations, and investigations relating to programs and operations of the Department of Defense,

b) provide leadership and coordination and recommend policies for activities designed to promote economy, efficiency, and effectiveness in the administration of, and to prevent and detect fraud and abuse in, such programs and operations,

c) provide a means for keeping the Secretary of Defense and the Congress fully and currently informed about problems and deficiencies relating to the administration of such programs and operations and the necessity for and progress of corrective action

http://www.dodig.mil

Search form

Audit of the DoD’s Management of the Cybersecurity Risks for Government Purchase Card Purchases of Commercial Off-the-Shelf Items

Related Open Recommendations