Open Recommendations

We recommend that GSA’s Chief Financial Officer and Chief Information Officer conduct a comprehensive assessment of GSA’s CIO-IT Security-19-97, IT Security Procedural Guide: Robotic Process Automation (RPA) Security, (RPA policy) to ensure, among other things, that its monitoring controls are effectively designed and implemented.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer develop oversight mechanisms to enforce compliance with the RPA policy and ensure that controls are operating effectively.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer review all system security plans that bots currently interact with to determine if they address bot and non-person entity access. Update the system security plans, as needed.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer review all system security plans that bots currently interact with to determine if the security controls need to be updated. Update the system security plans, as needed.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer develop a comprehensive process for removing bot custodian and bot developer access for decommissioned bots and GSA systems that: aligns with GSA’s CIO-IT Security-01-07, IT Security Procedural Guide: Access Control (AC) (access control policy); tracks and documents that access has been removed; and incorporates the process into the RPA policy.

Make ERM implementation a priority by providing the ERM team the resources it needs to ensure ERM reaches maturity no later than the planned date of FY 2028, in accordance with its current ERM Implementation Plan.

Ensure as SSA is working toward reaching maturity that the ERMC is providing leadership over the ERM program and that key Circular A-123 requirements are completed. For example, key requirements should include regular evaluation of SSA’s risk appetite and risk tolerance levels and ERMC communications in support of an Agency-wide risk culture.

Perform a risk-based allocation of resources based on system categorization.

Incorporate the system level risk assessment results into the organization-wide cybersecurity and privacy risk assessment.

Integrate the information security architecture with the development lifecycle.

Implement qualitative or quantitative measures to measure, report on, and monitor the information security and SCRM performance of organizationally defined products, systems, and services provided by external providers.

Implement qualitative or quantitative measures used to gauge the effectiveness of its component authenticity policies and procedures and ensures that data supporting the metrics is obtained accurately, consistently, and in a reproducible format.

Allocate resources in a risk-based manner.

Implement qualitative or quantitative measures on the effectiveness of the configuration management plan.

Ensure flaw remediation is centrally managed.

Implement qualitative or quantitative measures on the effectiveness of change control activities.

Deploy automation to centrally document, track, and share risk designations and screening information with necessary parties.

Deploy automation to support the management of privileged accounts, including for the automatic removal/disabling of temporary, emergency, and inactive accounts, as appropriate.

The FLRA should ensure that the security controls for protecting PII and other agency sensitive data, as appropriate, throughout the data lifecycle are subject to the monitoring processes defined within the organization's ISCM strategy.

Implement qualitative or quantitative measures on the performance of data exfiltration and enhanced network defenses.

Implement qualitative or quantitative measures on the effectiveness of the Data Breach Response Plan.

Obtain feedback from privacy training.

Assess training and talent of workforce.

Obtain feedback regarding training needs of workforce.

Implement qualitative or quantitative measures on the effectiveness of the ISCM policies and strategy.