FISMA 2016: DOT Continues to Make Progress, but the Department’s Information Security Posture Is Still Not Effective

Date Issued

Wednesday, November 9, 2016

Submitting OIG

Department of Transportation OIG

Agencies Reviewed/Investigated

Department of Transportation

Report Number

FI2017008

Report Type

Audit

Agency Wide

Yes

Number of Recommendations

Questioned Costs

Funds for Better Use

Hide this report from display

Yes

Open Recommendations

This report has 3 open recommendations.

Recommendation Number	Significant Recommendation	Recommended Questioned Costs	Recommended Funds for Better Use
3	Yes	$0	$0
Take action to work with FAA, FHWA, FMCSA, FTA, MARAD, NHTSA, and OST to develop risk acceptance memos for the expired systems identified in this report.
4	Yes	$0	$0
The Deputy Secretary, or his designee, take action to work with OST COE, FTA, and FAA, the common control providers, to report and update risk acceptance for shared controls that are not implemented in DOT's Repository (e.g., CSAM) per FISMA, OMB, and DOT requirements.
7	Yes	$0	$0
The Deputy Secretary, or his designee, take action to identify and document OST COE compensating controls when used to address security weaknesses in CSAM and system authorizations.