Federal Reports

Our FY 2012 Federal Information Security Management Act of 2002 (FISMA) review found that the Department had made progress in addressing issues identified in previous FISMA reviews. Specifically, it was compliant in 3 of the 11 reporting metrics: continuous monitoring, contractor systems, and security capital planning. However, we found that 6 of the 11 security control areas we reviewed—risk management, configuration management, remote access management, identity and access management, security training, and contingency planning—contained repeat or modified findings from OIG and contractor reports issued during the prior 3 years. The remaining two metric areas—incident response and reporting, and plan of action and milestones—contained new findings. Without adequate management, operational, and technical security controls in place, the Department’s systems and information are vulnerable to attacks that could lead to a loss of confidentiality and to a loss of integrity resulting from data modification or limited availability of systems. In addition to recommendations we made in the FY 2011 FISMA report, we made 22 new recommendations to assist the Department in establishing and sustaining an effective information security program.

This report is Sensitive But Unclassified. To obtain further information, please contact the OIG Office of Counsel at OIGCounsel@oig.treas.gov, (202) 927-0650, or by mail at Office of Treasury Inspector General, 1500 Pennsylvania Avenue, Washington DC 20220.