FISMA: Effectiveness of IAF's Information Security Program for FY 2025 Could Not Be Determined and Weaknesses Continue to Exist

Date Issued

Tuesday, February 24, 2026

Submitting OIG

U.S. Agency for International Development OIG

Agencies Reviewed/Investigated

Inter-American Foundation

Report Number

A-IAF-26-003-M

Report Type

Inspection / Evaluation

Location

United States

Number of Recommendations

Questioned Costs

Funds for Better Use

Report updated under NDAA 5274

Open Recommendations

This report has 6 open recommendations.

Recommendation Number	Significant Recommendation	Recommended Questioned Costs	Recommended Funds for Better Use
1	No	$0	$0
Conduct a comprehensive review of IAF's software and hardware inventories and update them to ensure that they are accurate and complete.
2	No	$0	$0
IAF's Chief Information Security Officer update IAF's procedures to include all elements for tracking the Agency's software and hardware assets. At a minimum these elements should include device type, location, and software license information.
3	No	$0	$0
IAF's Chief Information Security Officer conduct a security controls assessment for the two systems identified.
4	No	$0	$0
IAF's Chief Information Security Officer develop and implement procedures to hold system owners accountable for conducting security controls assessments and completing system security plans, and document which security controls are assessed and when.
5	No	$0	$0
IAF's Chief Information Security Officer update security plans for the two systems identified to include all required components as outlined in NIST Special Publication 800-53.
6	No	$0	$0
IAF's Chief Information Security Officer document the controls IAF is responsible for implementing for the external system identified and develop and implement a security plan for the system.