Despite the public nature of Federal Information Security Management Act cybersecurity requirements, the Office of Personnel Management\u2019s Office of the Chief Information Security Officer failed to supply adequate personnel and documentation for its most recent audit, according to an Office of Inspector General report.<\/p>\n\n\n\n
\u201cThe annual FISMA reporting metrics are publicly available documents, and are made available to OPM and the OIG at the same time, and are generally covering the same topics every year,\u201d the report said. \u201cIt would seem obvious that the OCIO should anticipate the required documentation and interview requests and stage the information in a readily accessible location. This audit is essentially an \u2018open book test,\u2019 but, inexplicably, OPM continues to struggle in providing timely documentation and appears to be generally unprepared to respond to routine audit requests.\u201d<\/p>\n\n\n\n
According to the report, the OCIO failed to invite proper experts to audit meetings and also failed to brief those that did attend on the topic of the meeting.<\/p>\n\n\n\n
The report also criticized OPM for not implementing recommendations from previous audits, a problem which can only compound on itself as time goes on.<\/p>\n\n\n\n
\u201cOPM is not making substantial progress in implementing our FISMA recommendations from prior audits,\u201d the report said. \u201cOPM has only closed 34 percent of the FISMA findings issued in the past two years, and we expect the number of new recommendations issued to significantly increase as the FISMA audits continue to evolve and look into new areas of the agency\u2019s technical operations.\u201d<\/p>\n\n\n\n
According to the report, the agency cited audit fatigue as a major factor in its inability to complete its mission, and that the audits put a strain on already scarce resources.<\/p>\n\n\n\n
\u201cAlthough we agree that audits can be a strain on resources, we believe that the primary cause of OPM\u2019s \u2018audit fatigue\u2019 is the OCIO staff\u2019s inability to maintain complete, detailed, and organized documentation,\u201d the report said. \u201cOPM has not implemented several of the FISMA requirements related to contingency planning, and continues to struggle with maintaining its contingency plans as well as conducting contingency plan tests on a routine basis.\u201d<\/p>\n\n\n\n
The OIG recommended that OPM hire a sufficient number of security staff to support agency IT systems. However, the OPM OCIO said that a gap in agency resource priorities versus cybersecurity priorities means that they aren\u2019t able to retain or back fill necessary positions.<\/p>\n\n\n\n
\u201cOCIO\u2019s resources have been impacted by budgetary uncertainties and the ensuing difficulties in planning and funding hiring actions in upcoming fiscal years,\u201d the OPM OCIO said in the report. \u201cOPM faces challenges in its ability to prioritize cybersecurity positions over other agency hiring decisions.\u201d<\/p>\n\n\n\n
However, the report found that current governance of that staff still hampers agency cybersecurity efforts.<\/p>\n\n\n\n
\u201cWe believe that this centralized security governance structure can be effective. However, the CISO organization continues to struggle in implementing long-standing cybersecurity controls required by FISMA,\u201d the report said. \u201cWe believe that OPM\u2019s security governance structure continues to represent a significant deficiency in the agency\u2019s internal controls. While resource limitations certainly impact the effectiveness of OPM\u2019s cybersecurity program, the staff currently in place is not fulfilling its responsibilities that are outlined in OPM policies and required by FISMA.\u201d<\/p>\n\n\n\n
Among the biggest problem areas for the agency were information security continuous monitoring and information security governance practices.<\/p>\n\n\n\n
\u201cOPM has established many of the policies and procedures surrounding ISCM, but the organization has not completed the implementation and enforcement of the policies,\u201d the report said. \u201cOPM also continues to struggle with conducting a security controls assessment on all of its information systems. This has been an ongoing weakness at OPM for over a decade.\u201d<\/p>\n\n\n\n
In fact, the report found that many of OPM\u2019s cybersecurity weaknesses stemmed from a lack of addressing previous review\u2019s recommendations<\/p>\n\n\n\n
Of the five maturity levels defined by the 2017 FISMA Reporting Metrics \u2013 ad hoc, defined, consistently implemented, managed and measurable, and optimized \u2013 the OIG gave OPM an overall ranking of Level 2, or defined, security.<\/p>\n","protected":false},"excerpt":{"rendered":"
Despite the public nature of FISMA cybersecurity requirements, OPM failed to supply adequate personnel and documentation for its most recent audit, according to an inspector general report.<\/p>\n","protected":false},"author":7,"featured_media":27480,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":9,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"9":{"categories":["daily-brief","newsletters","home"],"primary_category":""}}},"categories":[106,31,15,14,33,9],"tags":[],"coauthors":[2853],"class_list":["post-10741","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-management","category-it-networks","category-newsletters","category-federal-oversight"],"acf":{"subheadline":"","legacy_arc_id":"LUP7I7ETSJEB3PKDRK27LUMKGM","arc_canonical_url":"\/federal-oversight\/2017\/11\/07\/opm-fails-open-book-test-on-security\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n