Audit of the Federal Housing Finance Agency’s Information Security Programs and Practices Fiscal Year 2024

FHFA should develop and implement policies and procedures to oversee FHFA’s background reinvestigation process, including oversight controls over FHFA’s service provider.

FHFA should implement a process to monitor and ensure that background reinvestigations for relevant employees and contractors are conducted timely in accordance with FHFA and OPM standards.

FHFA-OIG's Chief Information Officer should update the service level agreement between FHFA-OIG and the service provider to include requirements for the service provider to provide background reinvestigation status reports on a regular basis.

FHFA-OIG's Chief Information Officer should establish and implement a process to make suitability adjudicative determinations and take suitability actions for covered positions in accordance with OPM’s regulation under Title 5 CFR, Part 731.103.

FHFA should work with the cloud system’s vendor to implement software updates that automatically disable user accounts after 365 days of inactivity, as required by the FHFA customer controls for the cloud system.

FHFA should complete the review and update of overdue SSPPs and Customer Control Plans in accordance with the existing related plans of action and milestones (POA&Ms).