Open Recommendations

We recommend that the Deputy Secretary and Chief Operating Officer require that OCIO and FSA incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the Configuration Management program.

We recommend that the Deputy Secretary and Chief Operating Officer require that OCIO and FSA migrate to Transport Layer Security 1.2 or higher as the only connection for all Department connections.

We recommend that the Deputy Secretary and Chief Operating Officer require that OCIO and FSA review solutions to ensure that the default username and password has been changed.

We recommend that the Deputy Secretary require OCIO to ensure that 51 websites are routed through a trusted internet connection or managed trusted internet protocol service.

We recommend that the Deputy Secretary require OCIO to ensure that all existing websites and services are accessible through a secure connection as required by OMB M-15-13

We recommend that the Chief Operating Officer require FSA to discontinue the use of unsupported operating systems, databases, and applications.

We recommend that the Chief Operating Officer require FSA to ensure that all websites and portals hosting personally identifiable information are configured not to display clear text.

We recommend that the Chief Operating Officer require FSA eliminate the use of Social Security numbers as an authentication element when logging into FSA websites by requiring the user to create a unique identifier for account authentication. (Repeat Recommendation FY 2018 & FY 2019).

We recommend that the Chief Operating Officer require FSA to immediately correct or mitigate the vulnerabilities identified during the security assessment

We recommend that the Chief Operating Officer require FSA to create corrective action plans to remedy database vulnerabilities for all database vulnerabilities identified.

We recommend that the Deputy Secretary and Chief Operating Officer require OCIO and FSA to ensure that terminated users' network access is removed timely.

We recommend that the Deputy Secretary and Chief Operating Officer require OCIO and FSA to ensure that access agreements for users accessing Department and FSA systems are documented and maintained. (Repeat Recommendation FY 2018 & FY 2019)

We recommend that the Deputy Secretary and Chief Operating Officer require OCIO and FSA to consistently document position risk designations for background investigations.

We recommend that the Deputy Secretary require OCIO to fully implement the Department's ICAM strategy to ensure that the Department meets full Federal government implementation of ICAM. (Repeat Recommendation FY 2018 & FY 2019)

We recommend that the Deputy Secretary require OCIO to ensure that the network access control solution is fully implemented to ensure identification and authentication of devices connected to the network.

We recommend that the Deputy Secretary require OCIO to validate the inactivity settings to ensure sessions time out after 30 minutes of inactivity.

We recommend that the Chief Operating Officer require FSA to fully implement the process for identifying, managing, and tracking activity of privileged user accounts.

We recommend that the Chief Operating Officer require FSA to enforce a two-factor authentication configuration for all user connections to systems and applications.

We recommend that the Chief Operating Officer require FSA to require system owners configure all websites to display warning banners when users login to Departmental resources and ensure that banners include approved warning language by October 31, 2019.

We recommend that the Deputy Secretary and the Chief Operating Officer require OCIO and FSA to incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the Data Protection and Privacy program.

We recommend that the Deputy Secretary require OCIO to ensure that Privacy Impact Assessments are reviewed every 2 years.

We recommend that the Deputy Secretary require OCIO to incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the Security Training program

We recommend that the Deputy Secretary require OCIO to ensure that all new users complete the mandatory training requirements before they receive access to Departmental systems.

We recommend that the Deputy Secretary and Chief Operating Officer require OCIO and FSA to ensure that the process for ensuring completion of role-based training is fully implemented.

We recommend that the Deputy Secretary and the Chief Operating Officer require OCIO and FSA to incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the ISCM program.