Open Recommendations

We recommend that the HHS OCIO work with the OPDIVs to ensure that they: Plan and execute resource staffing such that ATOs are kept up to date without a lapse of authorization.

We recommend that the HHS OCIO work with the OPDIVs to: - Ensure that the OPDIVs cybersecurity management create and implement a patch management strategy to ensure that patches are installed timely as required by HHS and Federal requirements.

We recommend that the HHS OCIO work with the OPDIV to: - Define a threat profiling framework that structures and standardizes threat profiling at the OPDIV.

We recommend that the HHS OCIO work with the OPDIVs to ensure that all ODPIVs: Conduct background checks on all personnel with information system access before they are granted access. The OPDIV should also conduct reinvestigations on these individuals in accordance with current personnel security policy.

We recommend that the HHS OCIO: Periodically sample systems to ensure that PIAs are created and maintained for all systems that require one.

We recommend that the HHS OCIO work with the OPDIVs to ensure that all ODPIVs: Ensure implementation of strong authentication mechanisms for privileged and non-privileged users to all OPDIV systems using multifactor PIV credentials, NIST 800-63 Identity Assurance Level 3/Authenticator Assurance Level 3/Federated Assurance Level 3 credential or other strong authentication for non-privileged and privileged users.

We recommend that the HHS OCIO: Work with the OPDIVs to monitor and validate each OPDIV’s implementation progress, which should include periodically sampling HHS systems to ensure the effectiveness of contingency plans, including adequate testing based on system categorization.

We recommend that the HHS OCIO work with the OPDIVs to: Identify roles of stakeholders to ensure proper identification of responsibilities in a shared responsibility environment.

We recommend that the HHS OCIO work with the OPDIVs to: Communicate the enterprise-wide configuration management plan to all HHS system owners and stakeholders.

We recommend that the HHS OCIO work with the ODPIVs ensure that: Role-based training is obtained for all users with significant security responsibilities before granting access to the system and annually thereafter.

We recommend that the HHS OCIO: Require each OPDIV to develop a POA&M to implement activities required to achieve an effective maturity level for contingency planning, pending HHS risk assessment.

We recommend that the HHS OCIO work with the OPDIV to: Implement threat profiling techniques within the defined framework that helps management understand where the OPDIV’s high-value assets are located, who could be interested in taking control of them, and what attack vectors and under which scenarios they would likely be used to exploit vulnerabilities to succeed in their pursuits.

The Information Security and Privacy Policy (IS2P) is HHS’ primary policy document governing cybersecurity which is pending a rewrite to address the upcoming requirements in NIST 800-53 revision 5. When this update occurs to the IS2P, HHS should: - Specify required cybersecurity control maturity levels in addition to identifying the selection of NIST controls. - Describe HHS’ Cybersecurity Shared Responsibility Model, including the key roles under centralized, federated and hybrid strategies for control implementation. Include responsibilities of the OCIO, the OPDIVs, and third-party stakeholders (including contractors). - Communicate that a Managed and Measurable or the optimal maturity level, based on…

We recommend that the HHS OCIO work with the OPDIVs to: Implement the enterprise-wide configuration management plan, working with system owners to align system configuration management plans with the enterprise plan.

We recommend that the HHS OCIO work with the ODPIVs ensure that: A process be designed and implemented that ensures the collection and maintenance of artifacts evidencing the successful completion of annual RBT for all users with significant security responsibilities.

We recommend that the HHS OCIO work with the OPDIVs to ensure that all ODPIVs: Create and implement a process to require privileged users to sign a privileged user rules of behavior agreement for all systems prior to provisioning privileged access to those systems.

We recommend that the HHS OCIO: Work with the OPDIVs to ensure that all PIAs are reviewed, approved and signed by the appropriate HHS personnel at a minimum within three (3) years of the last PIA approval date.

HHS should continue to provide department-wide guidance and DHS-supplied Continuous Diagnostics and Mitigation (CDM) tools to each OPDIV for the implementation of their ISCM programs.

We recommend that the HHS OCIO work with the ODPIVs ensure that: OPDIVs’ security management improve their processes to consistently and accurately track training to ensure that everyone has taken the training prior to granting them system access. Obtain and retain training certificates as evidence of completed training.

We recommend that the HHS OCIO work with the OPDIVs to: - Review the monthly reconciliation report, currently provided by the HHS OCIO, to ensure that discrepancies on the POA&M exception report are corrected to enable accurate OPDIV and Department-level reporting.

HHS should commit to creating and implementing a Cybersecurity Maturity Migration Strategy to advance the cybersecurity program from its current maturity state to an effective state across HHS. This strategy should include the following: - Perform a risk assessment and identify the optimal maturity level that achieves cost-effective security based on your missions and risks faced, risk appetite, and risk tolerance level. - Identify gaps between the current state at each OPDIV and the criteria required to reach the optimal level across HHS’ enterprise-wide cybersecurity program and develop security controls to implement effective security. - Ensure the requirements for all…

We recommend that the HHS OCIO work with the OPDIVs to ensure that all ODPIVs: Establish a repository to retain signed copies of privileged user rules of behavior agreements for holders of privileged access for all systems.

We recommend that OPM evaluate any study conducted pursuant to Recommendation 1 and, with due diligence, formulate recommendations and a plan for agency action based on the best interests of the government, the FEHBP, and its enrollees.

Improve and continue to implement ongoing risk communication efforts by promptly providing residents in all communities near the 25 ethylene oxide-emitting facilities identified as high-priority by the EPA with a forum for an interactive exchange of information with the EPA or the statesregarding health concerns related to exposure to ethylene oxide.

Using the results of recommendations one (1) and two (2) :a. Implement an automated solution to help maintain an up-to-date, complete, accurate, and readily available Agency-wide view of the security configurations for all its GSS components; Cybersecurity Team exports metrics and vulnerability reports and sends them to the CISO and CIO’s Office monthly for review. Develop a centralized dashboard that Cybersecurity Team and the CISO can populate for real-time assessments of compliance and security policies.b. Collaborate with DNFSB Cybersecurity Team Support to establish performance metrics in service level agreements to measure, report on, and monitor the risks related to contractor…