FHFA Did Not Fully Implement Select Security Controls Over One of Its Cloud Systems as Required by NIST and FHFA Standards and Guidelines

Date Issued

Wednesday, March 8, 2023

Submitting OIG

Federal Housing Finance Agency OIG

Other Participating OIGs

Federal Housing Finance Agency OIG

Agencies Reviewed/Investigated

Federal Housing Finance Agency

Report Number

AUD-2023-002

Report Type

Audit

Agency Wide

Yes

Number of Recommendations

Questioned Costs

Funds for Better Use

Open Recommendations

This report has 2 open recommendations.

Recommendation Number	Significant Recommendation	Recommended Questioned Costs	Recommended Funds for Better Use
AUD-2023-002-2	No	$0	$0
FHFA should develop and maintain a complete and accurate cloud system component inventory, as required by NIST SP 800-53.
AUD-2023-002-5	No	$0	$0
FHFA should develop and implement a solution to encrypt all data-at-rest on the cloud system as required by National Institute of Standards and Technology SP 800-53.