The U.S. Department of Education’s Federal Information Security Modernization Act of 2014 Report For Fiscal Year 2019

We recommend that the Deputy Secretary and Chief Operating Officer require OCIO and FSA to incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the Identity and Access Management program.

We recommend that the Deputy Secretary and Chief Operating Officer require that OCIO and FSA ensure that POA&M remediation is performed within the required timeframe.

We recommend that the Deputy Secretary and Chief Operating Officer require that OCIO and FSA incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the Configuration Management program.

We recommend that the Deputy Secretary and Chief Operating Officer require that OCIO and FSA review solutions to ensure that the default username and password has been changed.

We recommend that the Deputy Secretary require OCIO to ensure that all existing websites and services are accessible through a secure connection as required by OMB M-15-13

We recommend that the Chief Operating Officer require FSA to ensure that all websites and portals hosting personally identifiable information are configured not to display clear text.

We recommend that the Chief Operating Officer require FSA to immediately correct or mitigate the vulnerabilities identified during the security assessment

We recommend that the Deputy Secretary and Chief Operating Officer require OCIO and FSA to ensure that terminated users' network access is removed timely.

We recommend that the Deputy Secretary and Chief Operating Officer require OCIO and FSA to consistently document position risk designations for background investigations.

We recommend that the Deputy Secretary require OCIO to ensure that the network access control solution is fully implemented to ensure identification and authentication of devices connected to the network.

We recommend that the Chief Operating Officer require FSA to fully implement the process for identifying, managing, and tracking activity of privileged user accounts.

We recommend that the Chief Operating Officer require FSA to require system owners configure all websites to display warning banners when users login to Departmental resources and ensure that banners include approved warning language by October 31, 2019.

We recommend that the Deputy Secretary require OCIO to ensure that Privacy Impact Assessments are reviewed every 2 years.

We recommend that the Deputy Secretary require OCIO to ensure that all new users complete the mandatory training requirements before they receive access to Departmental systems.

We recommend that the Deputy Secretary and the Chief Operating Officer require OCIO and FSA to incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the ISCM program.

We recommend that the Deputy Secretary require OCIO to ensure the completion of Phases 1 and 2 of the CDM program. (Repeat Recommendation FY 2018 & FY 2019)

We recommend that the Deputy Secretary require OCIO to incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the Incident Response program.

We recommend that the Deputy Secretary require OCIO to ensure that data loss prevention technologies work as intended for the blocking of sensitive information transmission.

We recommend that the Chief Operating Officer require FSA to ensure that contingency plans, and other artifacts impacting contingency plans, are documented and updated in a consistent and timely manner.