Federal Reports

The Consolidated Reports Act of 2000 and Office of Management and Budget Circular A-136, Financial Reporting Requirements, require that the Office of Inspector General provide the agency head with a summary of the top management and performance challenges facing the agency. It is our assessment that the areas of financial management, human capital, information technology, administrative services, and awardee accountability represent the top management and performance challenges for the National Endowment for the Arts. Following is a discussion of each challenge area.

This is the audit of the NEA's information technology systems security. Due to security concerns, this report is not published on the internet. You can obtain a copy of this report through a freedom of information act request at the following link: https://www.arts.gov/freedom-information-act-guide.

Our objective was to determine whether the U.S. Department of Education’s (Department) and Federal Student Aid’s (FSA) overall information technology security programs and practices were effective as they relate to Federal information security requirements. The Fiscal Year 2018 Inspector General Federal Information Security Modernization Act of 2014 Reporting Metrics (FY 2018 IG FISMA Metrics) are grouped into five cybersecurity framework security functions that have a total of eight metric domains. Per the FY 2018 IG FISMA Metrics, we found the Department and FSA were not effective in any of the five security functions—Identify, Protect, Detect, Respond, and Recover. We also identified findings in all eight metric domains, of which seven are repeat findings.

The Federal Information Security Modernization Act of 2014 (FISMA) directs Inspectors General to conduct an annual evaluation of the agency information security program. FISMA, Department of Homeland Security (DHS), Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) establish information technology (IT) security guidance and standards for Federal agencies. We conducted this evaluation to assess the overall effectiveness of the Department of Housing and Urban Development’s information security program, assess their compliance with Federal guidance, and respond to OMB reporting questions for the fiscal year 2018 annual assessment.The OIG has determined that the contents of this report would not be appropriate for public disclosure and has therefore limited its distribution to selected officials. Please contact the Office of Evaluation at evaluations@hudoig.gov to request a copy of this report.