Audit of NARA's Management Control over Microsoft Access Applications and Databases

Submitting OIG:

National Archives and Records Administration OIG

Report Description:

This audit was conducted to identify MS Access applications and databases in use across NARA, assess the security controls for those applications and databases, and determine whether NARA is appropriately positioned to accommodate and maintain the applications and databases and security controls after the planned MS Access upgrade to a newer version.

Date Issued:

Friday, November 18, 2016

Agency Reviewed / Investigated:

National Archives and Records Administration

Submitting OIG-Specific Report Number:

17-AUD-04

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

View Document:

Attachment	Size
audit-management-control-over-microsoft-access-applications-and-databases.pdf	2.1 MB

Recommendation Number	Recommendation Status	Significant Recommendation
2	Open	Yes
We recommend the Chief Information Officer, in conjunction with each program office, implement the security assessment process as described in NARA’s Enterprise Architecture to those applications/databases determined critical to carrying out NARA’s or program offices’ missions from Recommendation 1.
3	Open	Yes
We recommend the Chief Information Officer, in conjunction with each program office, develop and implement a comprehensive, systematic process to determine when a MS Access application or database should be recognized as an IT system.
4	Open	Yes
We recommend the Chief Information Officer, in conjunction with each program office: Determine all MS Access databases containing PII and ensure they are: (a) encrypted in storage and transmission; and (b) password-protected in accordance with NARA Directive 1608 and the Privacy Act.
5	Open	Yes
Develop and implement a process, for future MS Access applications and databases created by program offices, including notification to and approval from the Office of Information Services for those that are mission-critical and/or contain PII or otherwise sensitive information.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Yes

We recommend the Chief Information Officer, in conjunction with each program office, implement the security assessment process as described in NARA’s Enterprise Architecture to those applications/databases determined critical to carrying out NARA’s or program offices’ missions from Recommendation 1.

Open

Yes

We recommend the Chief Information Officer, in conjunction with each program office, develop and implement a comprehensive, systematic process to determine when a MS Access application or database should be recognized as an IT system.

Open

Yes