DHS - OIG-24-61 - 3

We recommend that the ICE Office of the Chief Information Officer develop and implement policies and procedures to improve the vulnerability management process to ensure:• credentialed scans are completed and assessed, per DHS guidance;• limitations posed by non-credentialed scans are properly and promptly reported per DHS guidance;• plans to address vulnerabilities are created and implemented promptly, per DHS guidance; and• formal acceptance of, or mitigate the risk of, noncompliant enterprise-level system settings.