FISMA: USAID Implemented an Effective Information Security Program for Fiscal Year 2024 but Longstanding Weaknesses Persist

Audit Report
Report Number
A-000-24-005-C

Why We Did This Audit

· We contracted with the independent certified public accounting firm of RMA Associates LLC (RMA) to conduct an audit of USAID’s information security program in support of the Federal Information Security Modernization Act of 2014 (FISMA) and in accordance with generally accepted government auditing standards.

· FISMA requires federal agencies to develop, document, and implement an agency-wide information security program to protect their information and information systems. FISMA also requires the agency Inspectors General (IGs) to assess the effectiveness of agency information security programs and practices and report the results of the assessments to the Office of Management and Budget.

· The audit objective was to determine whether USAID implemented an effective information security program.

What We Found

· RMA concluded that USAID implemented an effective information security program. However, RMA found weaknesses in four of nine IG FISMA metric domains.

· RMA also concluded that USAID did not take final corrective action on two open recommendations from the fiscal year 2020 FISMA audit.

Why It Matters

· FISMA provides a comprehensive framework for ensuring effective security controls over information resources supporting Federal operations and assets.

· We made seven new recommendations in addition to the two prior FISMA audit recommendations that USAID has not yet implemented to address the weaknesses identified in the report. USAID concurred with recommendations 1 and 3-7 and partially agreed with recommendation 2.

A-000-24-005-C.pdf921.63 KB

Recommendations

Recommendation
7

We recommend that USAID's Chief Information Officer update the
event logging checklist to include details of event logging level 3 (advanced) applicability and implement requirements as specified by Office of Management and Budget Memorandum M-21-31.

Questioned Cost
0
Funds for Better Use
0
Recommendation
4

We recommend that USAID's Chief Information Officer implement accurate automated dashboards to provide enterprise-wide metrics to inform top management of its information technology risks.

Questioned Cost
0
Funds for Better Use
0
Recommendation
5

We recommend that USAID's Chief Information Officer establish and implement a process to track the progress of conducting annual reviews and related lessons learned from the implementation of its Information Security Continuous Monitoring Strategy.

Questioned Cost
0
Funds for Better Use
0
Recommendation
3

We recommend that USAID's Chief Information Officer develop and
implement procedures to document deviations from Agency policy on security control assessments, including acceptance of the risk of such deviations.

Questioned Cost
0
Funds for Better Use
0
Recommendation
6

We recommend that USAID's Chief Information Officer establish a
formal training program in counterfeit component detection to educate responsible personnel. The training should cover identifying counterfeit hardware, software, and firmware components and should be updated regularly.

Questioned Cost
0
Funds for Better Use
0
Close Date
Recommendation
2

We recommend that USAID's Chief Human Capital Officer request its
cognizant Management Council on Risk and Internal Control to report and track as a significant deficiency to the Agency the risk of not maintaining records evidencing that staff have been offboarded in accordance with Agency policy, as identified in Office of Inspector General Report
No. A-000-21-004-C, Recommendation 3.

Questioned Cost
0
Funds for Better Use
0
Recommendation
1

We recommend that USAID's Chief Information Officer request its
cognizant Management Council on Risk and Internal Control to report and track as a significant deficiency to the Agency the risk of not timely disabling network accounts for separated employees and contractors, as identified in Office of Inspector General Report No. A-000-21-004-C, Recommendation 2.

Questioned Cost
0
Funds for Better Use
0