TOIG - OIG-19-007 - 3-1

Departmental Offices (DO) management should define and document the process of monitoring and reviewing the security authorization package and risks and controls identified for the DO System 2 by the service provider, as required by DO Information Technology Security Policy (DO P 910), Department of the Treasury Information Technology Security Program (TD P 85-01), and National Institute of Standards and Technology Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations (NIST SP 800-53, Rev. 4).