Open Recommendations

We recommend that management design and implement controls that require the validation of the relevance and reliability of underlying data used in developing the assumptions related to the subsidy cost estimates. Such review should be documented and maintained.

We recommend that the Department evaluate, develop, and implement a formal process to track and report all new and separated contractors.

We recommend that the Department ensure separated contractors are off-boarded and system personnel are notified in a timely manner to disable or remove access to IT resources.

We recommend that the Department provide training and oversight to the Department’s personnel with on/off-boarding responsibilities to help ensure new/separated contractors are properly tracked.

We recommend that the Department update access review procedures to require the reviewers to verify the access lists received to be used in the performance of the access reviews is complete and accurate and not modified prior to commencing the access reviews.

We recommend that the Department identify and implement a process for the reviewer to validate the population generated for review is complete and accurate.

We recommend that the Department enforce established access authorization controls and ensure all requirements are met prior to granting system access.

We recommend that the Department formally perform and document the periodic reviews of all database user accounts in accordance with Department policy to confirm access is current, authorized, and commensurate with job responsibilities.

We recommend that the Department ensure the application and database server access reviews include the verification of access privileges assigned to the user accounts are commensurate with job responsibilities and follow the concept of least privilege.

We recommend that the Department evaluate ensure the database and server layers comply with the disabling of inactive accounts and account lockout duration password setting requirements, as required by Department policy.

We recommend that the Department adhere to the SSP control requirements and avoid the use of generic and shared accounts. If generic and shared accounts are required, obtain a formal risk acceptance and develop a policy and procedure to: • Authorize the use of these accounts by approved personnel, • Control who can access the generic/shared accounts and those sensitive actions performed by the accounts are logged and reviewed every time the accounts are used, and • Require that generic/shared accounts’ passwords are changed each time approved personnel separate or transfer from the Department.

We recommend that FSA implement a process to evaluate the magnitude of impact, likelihood of occurrence, and nature of the deficiency in order to tailor the corrective actions to remediate the risk and address the root cause. Further, update guidance to ensure that quality reviews over the POA&M closure documentation are conducted to confirm the noted deficiencies are fully addressed to help prevent future reoccurrences.

We recommend that FSA formally develop and implement a quality control review process to ensure that logical access control processes are followed completely and accurately to validate logical access requests, reviews, and recertifications.

We recommend that FSA ensure segregation of duties and least privilege principles are adhered to when granting user access to prevent users from having the ability to develop and/or change application code and having update access to the environment where the final tested and approved changes are staged prior to migration to the production environment; and prevent users with access to develop code from having update access to the production environment.

We recommend that FSA evaluate and update the access review control process based on risk and enforce segregation of duties.

We recommend that FSA reconcile the list of users’ roles and responsibilities per the identity and access software tools to the lists that reside in each system accessed by such users.

We recommend that FSA update access review procedures to require the reviewer to verify the access list, received to be used in the performance of the access reviews, is complete and accurate and not modified prior to commencing the access reviews.

We recommend that FSA enforce established access authorization controls and ensure all requirements are met prior to granting access to systems.

We recommend that FSA ensure a complete and accurate population of application changes is provided. Formally develop and implement a quality control review process to ensure that the application change control process is followed and consistently and accurately documented.

We recommend that management implement the following to improve the effectiveness of entity-level controls: improve the risk assessment process at the financial statement assertion level and at the process level to ensure the department is appropriately defining objectives to enable the identification of risks and define risk tolerances.

We recommend that management implement the following to improve the effectiveness of entity-level controls: implement key monitoring controls to ensure that corrective action plans are implemented to timely remediate control deficiencies identified. In addition, increase oversight, review, and accountability over the process among various offices and directorates within the Department and FSA.

We recommend that management design and implement controls that require the validation of the relevance and reliability of underlying data used in developing the assumptions related to the subsidy cost estimates. Such review should be documented and maintained.

We recommend that the Department evaluate, develop, and implement a formal process to track and report all new and separated contractors.

We recommend that the Department ensure separated contractors are off-boarded and system personnel are notified in a timely manner to disable or remove access to IT resources.

We recommend that the Department provide training and oversight to the Department’s personnel with on/off-boarding responsibilities to help ensure new/separated contractors are properly tracked.