We recommend that the DHS Office of the Chief Security Officer address planning, policy, and acquisition deficiencies prior to further implementation of the expanded scope of the Insider Threat Program. Specifically, the alert highlighted deficiencies we identified in planning and implementing of the expanded Insider Threat Program, including issues with acquisition management, and revision and completion of required documentation. These issues required immediate attention and corrective action to ensure efficiency and effectiveness of the program. We issued four recommendations and the Department concurred with all of them.
Open Recommendations
Recommendation Number | Significant Recommendation | Recommended Questioned Costs | Recommended Funds for Better Use | Additional Details | |
---|---|---|---|---|---|
1 | No | $0 | $0 | ||
We recommend the DHS Office of the Chief Security Officer review DHS logon banners for unclassified systems at all components and determine whether they are legally sufficient. | |||||
3 | No | $0 | $0 | ||
We recommend the DHS Office of the Chief Security Officer determine, with the aid of the Office of Program Accountability and Risk Management, whether the expanded ITP is an acquisition program, what level of acquisition program it is using a Rough Order Magnitude or other Cost Estimate, and where the program is in the Acquisition Life Cycle. Determine, along with the Office of Program Accountability and Risk Management, the acquisition documentation required for the Acquisition Life Cycle Framework phase the program is in. | |||||
4 | No | $0 | $0 | ||
We recommend the DHS Office of the Chief Security Officer work with the Office of Program Accountability and Risk Management to complete the required Systems Engineering Life Cycle Framework. |