Federal Reports

The unclassified version of the SAR covers the period from 1 April 2021 – 30 September 2022, and reflects what the NSA OIG could release publicly about its work for that SAR Report Cover reporting period. The OIG made 327 recommendations that we believe will be impactful in improving the economy, efficiency, and effectiveness of this critical Agency's operations. The Director of the NSA and Congress previously received the classified version of the SAR in accordance with the IG Act.

This report summarizes the results of our fiscal year (FY 2022) Federal Information Security Modernization Act (FISMA) evaluation and assesses the maturity of controls used to address risks in each of the nine information security areas, called domains. We assessed the effectiveness of information security programs on the required maturity model spectrum, which is a rating scale for information security. We rated the Denali Commission’s overall program of information security as “effective.” A majority of the FY 2022 FISMA metrics were rated Defined (Level 2). Three of four recommendations for corrective action from the FY 2021 evaluation have been implemented.