DOT Has Not Met Federal Targets for Implementing Components of Its Information Security Continuous Monitoring Program

What We Looked At The Office of Management and Budget (OMB) requires Federal agencies to implement Information Security Continuous Monitoring (ISCM), which entails the near real-time detection of cybersecurity risks, threats, and malicious activity. ISCM enables agencies to more effectively address evolving, frequent, and increasingly aggressive cybersecurity attempts to compromise Federal information systems. A large number of systems at the Department of Transportation (DOT) contain sensitive data that require protection; accordingly, we initiated this audit. Our audit objectives were to assess (1) how DOT's ISCM program conforms to OMB and National Institute of Standards and Technology requirements and (2) the status and progress of DOT's implementation of its ISCM program. This review also supports our annual audit mandated by the Federal Information Security Modernization Act. What We Found DOT's program lacks a procedure for verifying Federal Aviation Administration (FAA) performance data reported to OMB. While DOT has met the requirement to submit quarterly reports, we identified significant errors in one submission. The Department also lacks adequate procedures for providing accurate submissions to OMB. In addition, FAA has not yet completed phase 1 of the Continuous Diagnostics and Mitigation Program, which targets the management of cybersecurity assets and activities. Finally, FAA does not have procedures for reporting on or validating its Cross Agency Priority goal data and cannot be certain those data are accurate. Our Recommendations DOT concurred with our three recommendations to improve its ISCM program.