Open Recommendations

Implement qualitative or quantitative measures on the effectiveness of change control activities.

Deploy automation to centrally document, track, and share risk designations and screening information with necessary parties.

Deploy automation to support the management of privileged accounts, including for the automatic removal/disabling of temporary, emergency, and inactive accounts, as appropriate.

The FLRA should ensure that the security controls for protecting PII and other agency sensitive data, as appropriate, throughout the data lifecycle are subject to the monitoring processes defined within the organization's ISCM strategy.

Implement qualitative or quantitative measures on the performance of data exfiltration and enhanced network defenses.

Implement qualitative or quantitative measures on the effectiveness of the Data Breach Response Plan.

Obtain feedback from privacy training.

Assess training and talent of workforce.

Obtain feedback regarding training needs of workforce.

Implement qualitative or quantitative measures on the effectiveness of the ISCM policies and strategy.

Implement qualitative or quantitative measures that have been defined in the Incident Response Plan to monitor and maintain the effectiveness of an overall incident response capability.

Perform risk-based allocation for stakeholders to effectively implement incident response activities.

Implement qualitative or quantitative measures to ensure the effectiveness of incident detection and analysis policies and procedures.

FLRA should monitor and analyze qualitative and quantitative performance measures on the effectiveness of incident handling policies and procedures.

Incident response metrics should be used to measure and manage the timely reporting of incident information to organizational officials and external stakeholders.

FLRA should employ automated mechanisms to test system contingency plans more thoroughly and effectively.

Assess backups.

The auditors recommend that the Chief Information Officer require the Department and FSA to capture the missinghardware data elements for each identified system and assess whether other information systems may be missing similaror related data elements.

The auditors recommend that the Chief Information Officer require the Department and FSA to further define the oversightcontrols that are in the current policy to ensure all Departmental systems consistently utilize the inventory template whencompleting/updating the hardware inventory.

The auditors recommend that the Chief Information Officer require the Department and FSA to capture the missingsoftware data elements for each identified system and assess whether other information systems may be missing similaror related data elements.

The auditors recommend that the Chief Information Officer require the Department and FSA to further define the oversightcontrols that are in the current policy to ensure all Departmental systems consistently utilize the inventory template whencompleting/updating the software inventory.

The auditors recommend that the Chief Information Officer require the Department and FSA to review and approve theUSDS-MaxED/AidVntge and EDAWSEW MOU. Furthermore, the Department and FSA should update existingprocedures and ensure all MOUs reflect the appropriate two-year review cycle.

The auditors recommend that the Chief Information Officer require the Department and FSA to implement a process tomonitor that PRDs are reviewed and signed prior to the security investigation.

The auditors recommend that the Chief Information Officer require the Department and FSA to implement an automationprocess to centrally document, track, and share risk designation and screening information.

The auditors recommend that the Chief Information Officer require the Department and FSA to reinforce their process fordocumenting the authorization, review, and approval of PUAs.