Federal Reports

The Federal Information Security Modernization Act of 2014 (FISMA) requires each agency’s Inspector General (IG) to conduct an annual independent evaluation to determine the effectiveness of the information security program (ISP) and practices of its respective agency. Our objective was to evaluate the Tennessee Valley Authority’s ISP and agency practices for ensuring compliance with FISMA and applicable standards, including guidelines issued by Office of Management and Budget and National Institute of Standards and Technology. Our audit scope was limited to answering the FY 2019 IG FISMA metrics developed as a collaborative effort by the Office of Management and Budget, Department of Homeland Security, and Council of Inspector Generals on Integrity and Efficiency in consultation with the Federal Chief Information Officer Council. The FY 2019 IG FISMA metrics recommend a majority of the functions be at a maturity level 4 (managed and measurable) or higher to be considered effective. Based on our analysis of the metrics and associated maturity levels defined with the IG FISMA metrics, we found three of the five functions fell below the targeted level 4; therefore, TVA’s ISP was not operating in an effective manner. We made eight specific recommendations to TVA management to make improvements in the ISP.

The Child Care and Development Block Grant Act (CCDBG Act) of 2014 added new requirements for States that received funding from the Child Care and Development Fund (CCDF) to conduct comprehensive criminal background checks on staff members and prospective staff members of childcare providers every 5 years. Criminal background check requirements apply to any staff member who is employed by a childcare provider for compensation or whose activities involve the care or supervision of children or unsupervised access to children.

The CSB lacks documented procedures to address information technology risks and threats from cybersecurity incidents.

The Office of Inspector General (OIG) completed a final action verification (FAV) of all four recommendations in our September 28, 2015 report, Healthy Hunger-Free Kids Act of 2010— Controls over Food Service Account Revenue (Audit Report 27601-0001-22). An FAV determines whether the final action documentation the agency provided to the Office of the Chief Financial Officer (OCFO) supports the agency’s management decision reached with OIG.1, 2 Our objective was to determine whether the documentation the Food and Nutrition Service (FNS) provided to OCFO was sufficient to close the recommendations made in Audit Report 27601-0001-22.