The U.S. Department of Education’s Federal Information Security Modernization Act of 2014 Report For Fiscal Year 2019

Our objective was to determine whether the U.S. Department of Education’s (Department) and Federal Student Aid’s (FSA) overall information technology security programs and practices were effective as they relate to Federal information security requirements. We found the Department and FSA programs were not effective in any of the five security functions—Identify, Protect, Detect, Respond, and Recover. We also identified findings in all eight metric domains, which included findings with the same or similar conditions contained in prior Office of Inspector General reports.