Stay Informed
of New Reports
Twitter
Where To Report Waste
Fraud, Abuse, Or Retaliation
Where To Report Waste Fraud, Abuse, Or Retaliation

Federal Information Security Modernization Act Audit Fiscal Year 2018

Related Open Recommendations

Recommendation Number Recommendation Status Significant Recommendation Additional Details
9 Open No
We recommend that OPM define policies and procedures for a centralized software inventory.
10 Open No
We recommend that OPM define the standard data elements for an inventory of software assets and licenses with the detailed information necessary for tracking and reporting, and that it update its software inventory to include these standard data elements.
12 Open No
We recommend that OPM update its enterprise architecture to include the information security architecture elements required by NIST and OMB guidance.
14 Open No
We recommend that OPM adhere to remediation dates for its POA&M weaknesses.
15 Open No
We recommend that OPM update the remediation deadline in its POA&Ms when the control weakness has not been addressed by the originally scheduled deadline (i.e., the POA&M deadline should not reflect a date in the past and the original due should be maintained to track the schedule variance).
16 Open No
We recommend that OPM complete risk assessments for each major information system that are compliant with NIST guidelines and OPM policy. The results of a complete and comprehensive test of security controls should be incorporated into each risk assessment.
19 Open No
We recommend that OPM perform a gap analysis to determine the configuration management resource requirements (people, processes, and technology) necessary to effectively implement the agency’s CM program.
20 Open No
We recommend that OPM document the lessons learned from its configuration management activities and update its configuration management plan as appropriate.
21 Open No
We recommend that OPM develop and implement a baseline configuration for all information systems in use by OPM.
23 Open No
We recommend that the OCIO develop and implement [standard security configuration settings] for all operating platforms in use by OPM.

Pages

Displaying 10 of 21 Recommendations