Fiscal Year 2025 Federal Information Security Modernization Act

View Report

Date Issued

Tuesday, May 19, 2026

Submitting OIG

Small Business Administration OIG

Agencies Reviewed/Investigated

Small Business Administration

Report Number

26-10

Report Description

This report summarizes the results of our fiscal year 2025 Federal Information Security Modernization Act (FISMA) evaluation of the U.S. Small Business Administration’s (SBA) information security program.

We found SBA’s overall information security program has defined policies but the agency has not consistently implemented them, falling short of the Office of Management and Budget rating for effective security controls. SBA fell below the baseline for effective controls in 9 of the 10 domains. Domains are metrics used to assess the effectiveness of an agency’s information security program. SBA made progress in 1 of the 10 domains, incident response, which was rated as optimized, exceeding the baseline for effective security controls. SBA regressed in three other domains: information security and continuous monitoring, identity and access management, and risk and asset management.

This fiscal year there are 17 new recommendations to improve SBA’s IT security program. Additionally, the agency continues to make progress on implementing 13 open recommendations from 4 prior evaluations. SBA managers agreed and proposed corrective actions that resolved all recommendations.

Report Type

Inspection / Evaluation

Agency Wide

Yes

Number of Recommendations

Questioned Costs

Funds for Better Use

Report updated under NDAA 5274

Open Recommendations

This report has 17 open recommendations.

Recommendation Number	Significant Recommendation	Recommended Questioned Costs	Recommended Funds for Better Use
1	Yes	$0	$0
Complete the implementation of a new governance risk and compliance tool to assist in the timely completion of SBA’s annual security control assessments in coordination with the Office of the Chief Financial Officer.
2	Yes	$0	$0
Update SBA policy and procedures to clearly define the term “annual” and specify whether it refers to a period of 365 days or aligns with the fiscal year ending on September 30.
3	Yes	$0	$0
Ensure the agency follows the policy to perform security control assessments annually, either on a rolling 365-day basis or aligned with the fiscal year ending on September 30.
4	Yes	$0	$0
Update the SBA Standard Operating Procedure (SOP) 20 21 4, The Small Business Administration Acquisition and Procurement Program, January 16, 2025, Appendix C — Cybersecurity and Supply Chain Risk for IT Acquisitions, to reflect the new process in which third-party supply chain risks will be continuously monitored through the Office of the Chief Information Officer.
5	Yes	$0	$0
Implement policies, procedures, and processes for developing and maintaining an accurate inventory of data and its corresponding metadata from third parties.
6	Yes	$0	$0
Improve the governance, risk, and compliance systems to track cybersecurity risks.
7	Yes	$0	$0
Develop and implement a process to monitor program offices’ completion of required annual reviews of interconnection security agreements and ensure program officials review and sign the agreements prior to their expiration.
8	Yes	$0	$0
Improve the existing process to manage personal identity verification exemptions.
9	Yes	$0	$0
Ensure that system owners perform annual privileged user access reviews in accordance with SBA policies.
10	Yes	$0	$0
Provide system owners and individuals with training or other communication emphasizing requirements for approving privileged user access prior to granting access.
11	Yes	$0	$0
Ensure program offices review all system security plans and confirm they are updated, approved, and signed annually by the system owner, information systems security officer, and the information systems security manager.
12	Yes	$0	$0
Document procedures, roles, and responsibilities for performing an annual functional test to ensure that the alternative backup site keeps the system operational in accordance with SBA policy and procedures.
13	Yes	$0	$0
Annually perform functional testing to include failover testing in accordance with SBA policy and procedures.
14	Yes	$0	$0
Establish procedures to monitor program officials’ compliance with SOP 90 47 6, Cybersecurity and Privacy Policy, requirements to ensure information system contingency plans are developed, tested annually, and updated as needed.
15	Yes	$0	$0
Review and update the information system contingency plans and business impact assessments and ensure that key attributes are included.
16	Yes	$0	$0
Update the information system contingency plans and business impact assessments at least once a year and include the recovery priority and lessons learned.
17	Yes	$0	$0
Conduct the information system contingency plans to include a business impact assessment at least annually.