Quality Control Review of the Independent Auditor's Report on DOT's Information Security Program and Practices

Submitting OIG:

Report Description:

What We Looked At This report presents the results of our quality control review (QCR) of an audit of the Department of Transportation's (DOT) information security program and practices. The Federal Information Security Modernization Act of 2014 (FISMA) requires agencies to develop, implement, and document agencywide information security programs and practices. The act also requires agencies to have annual independent reviews to determine the effectiveness of their programs, and report the results of these reviews to the Office of Management and Budget (OMB). To meet this requirement, we contracted with CliftonLarsonAllen LLP (CLA) to conduct this audit subject to our oversight. The audit objective was to determine the effectiveness of DOT's information security program and practices in five function areas--Identify, Protect, Detect, Respond, and Recover. What We Found We performed a QCR of CLA's report and related documentation. Our QCR disclosed no instances in which CLA did not comply, in all material respects, with generally accepted Government auditing standards. Recommendations DOT concurs with 1 of CLA's 14 recommendations and partially concurs with the remaining 13 recommendations. ClA considers recommendations 1, 2, 4, 8, 9, 10, 11, and 12 resolved but open pending completion of planned actions. CLA considers recommendations 3, 5, 6, 7, 13, and 14 open and unresolved.

Date Issued:

Wednesday, October 23, 2019

Agency Reviewed / Investigated:

Department of Transportation

Submitting OIG-Specific Report Number:

QC2020002

Component, if applicable:

Office of the Secretary of Transportation

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Additional Details Link:

https://www.oig.dot.gov/library-item/37529

Recommendation Number	Recommendation Status	Significant Recommendation	Additional Details
1	Open	Yes	https://www.oig.dot.gov/library-item/37529
Perform a review of all Plans of Action and Milestone (POA&M) items closed during the audit period to include supporting documentation and re-approve their closure.
2	Open	Yes	https://www.oig.dot.gov/library-item/37529
Revise current security weakness management policies and procedures (documenting within a revision history table) to require documented evidence such as calendar appointments, meeting minutes, etc. in support of POA&M closure decisions to be uploaded into CSAM.
3	Open	Yes	https://www.oig.dot.gov/library-item/37529
Work with the OA CIOs to review current assessment and authorization processes and implement a validation process to ensure updated security plans, ATOs and risk assessments are reviewed and updated to reflect all system (including privacy) controls, vulnerabilities, and that current risks are clearly presented to the authorizing officials.
4	Open	Yes	https://www.oig.dot.gov/library-item/37529
Work with the OA CIOs to develop mechanisms to ensure updated system security plans and assessments of security controls (that were previously assessed as not satisfied or partially satisfied) reflect current operational environments, including an accurate status of the implementation of system security controls, and all applicable security controls are properly evaluated.
5	Open	Yes	https://www.oig.dot.gov/library-item/37529
Document OA subnets and OA responsibilities for devices and systems operating on the Common Operating Environment.
6	Open	Yes	https://www.oig.dot.gov/library-item/37529
Document and implement network segmentation to reduce the attack surface or susceptibility of vulnerable and sensitive OA assets in the Common Operating Environment.
7	Open	Yes	https://www.oig.dot.gov/library-item/37529
Work with OAs to remediate outstanding identity and access management weaknesses through implementation and closure of POA&Ms and control assessments to determine whether these risks were addressed.
11	Open	Yes	https://www.oig.dot.gov/library-item/37529
Resolve any inconsistencies with respect to Departmental policies and procedures, which prescribe conflicting directions on whether DOT components are required to provide, develop and update incident response plans, documenting evidence of review and revisions within a history log.
12	Open	Yes	https://www.oig.dot.gov/library-item/37529
Implement a process to ensure incident response plans are developed for all OAs and updated on at least an annual basis.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Yes

https://www.oig.dot.gov/library-item/37529

Perform a review of all Plans of Action and Milestone (POA&M) items closed during the audit period to include supporting documentation and re-approve their closure.

Open

Yes

https://www.oig.dot.gov/library-item/37529

Revise current security weakness management policies and procedures (documenting within a revision history table) to require documented evidence such as calendar appointments, meeting minutes, etc. in support of POA&M closure decisions to be uploaded into CSAM.