Public Report on the Federal Communications Commission’s Fiscal Year 2023 Federal Information Security Management Act Evaluation

This audit report determined that the Commission’s FY 2023 information security program was not in compliance with FISMA legislation, OMB guidance, and applicable NIST special publications. Five of the nine domains Kearney evaluated warrant additional management attention to address identified deficiencies - Risk Management, Supply Chain Risk Management, Configuration Management, Identity and Access Management, and Information Security Continuous Monitoring. Specifically, the FISMA evaluation report includes seven findings and offers 25 recommendations to improve the effectiveness of the FCC’s information security program controls. FCC continues to work towards an effective overall maturity level for its information security program.