{"id":23421,"date":"2015-11-09T20:20:26","date_gmt":"2015-11-09T20:20:26","guid":{"rendered":"https:\/\/one.sightlinemg.com\/federaltimes\/uncategorized\/2015\/11\/09\/ig-energy-department-missing-mark-on-risk-management\/"},"modified":"2026-08-08T04:55:07","modified_gmt":"2026-08-08T04:55:07","slug":"ig-energy-department-missing-mark-on-risk-management","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/federaltimes\/management\/2015\/11\/09\/ig-energy-department-missing-mark-on-risk-management\/","title":{"rendered":"IG: Energy Department missing mark on risk management"},"content":{"rendered":"\n

The Department of Energy is making progress implementing a risk management framework, however the agency has lagged in identifying exactly what information and systems should be included under that framework, according to a new inspector general report<\/a>.<\/span><\/p>\n\n\n\n

“The weaknesses identified existed, in part, because federal requirements and best practices for securing information systems had not been fully implemented,” the IG wrote. “In addition, officials at the programs and sites reviewed had not always provided effective monitoring and oversight of security activities or communicated important risk management information to the appropriate individuals.”<\/p>\n\n\n\n\n\n

Officials tasked with securing information need those classifications to ensure data and systems are protected at the right levels.<\/p>\n\n\n\n

“Failing to do so can result in under-protecting the system by not implementing all appropriate controls,” the IG wrote. “This could place important assets and sensitive data at increased risk of unnecessary loss or disclosure, potentially impairing the department’s ability to accomplish its mission.”<\/p>\n\n\n\n

Brookhaven National Laboratory, for example, had not tested implementation of its security controls on any of the three systems reviewed by the IG.<\/p>\n\n\n\n

“As a result, the authorizing official did not have assurance that control test results were valid and could be used to make credible, risk-based decisions,” according to the report.<\/p>\n\n\n\n

The IG also noted BNL’s policy of having the same cybersecurity official test and implement security controls was in violation of federal regulations, which require an independent assessment.<\/p>\n\n\n\n\n\n

There were some positive mentions in the IG’s report:<\/p>\n\n\n\n