United States DEPARTMENT of Commerce

A P P E N D I x C : P e r f o r m a n c e M e a s u r e s D e f i n i t i o n s
and/or operational phases are monitored to ensure the required functionality is delivered on the schedule and at the cost
projected. Program offices regularly report on the progress and status of their efforts against the cost, schedule, and performance
goals, a process that provides early warning signals for corrective actions. Where needed, program managers are required to
develop and implement corrective actions to meet the program goals. The successful implementation of each program critical
to the Department’s missions depends in some way on the adequacy and security of the IT systems that operate throughout the
Department. If security of any of these systems were to be compromised, the effective accomplishment of the Department’s
mission would be in jeopardy. To ensure that these systems are adequately protected (and the Nation reaps the benefits of the
Department’s work), certification and accreditation requirements have been established. Certification represents the complete
testing of all management, operational, and technical controls that protect a system. These controls are documented in the
security plan. By approving the plan, the system owner warrants that the controls provide adequate protection for the system.
Certification verifies the adequacy of these controls and also validates that the controls are implemented and functioning
effectively. Accreditation is the senior program official’s acknowledgement of the risk of operating the system. It provides official
approval to run the system in the operational environment. Recertification and reaccreditation follow updates of risk assessments
and security plans every three years or upon major system modification.
Data Source
Bureau IT offices
Frequency
Annually
Data Storage
Bureau IT offices, bureau files, and DM Chief Information Officer (CIO) files
Internal Controls Departmental and outside reviews
Data Limitations None
Actions to be Taken Review bureau processes to assess need for action; review security plans for completeness and conformance with NIST SP 800-18.
Performance Outcome: Promote improvements to Commerce programs and operations by identifying and completing
work that (1) promotes integrity, efficiency, and effectiveness; and (2) prevents and detects fraud, waste, and abuse
(OIG)
Performance Measure:
Percentage of OIG recommendations accepted by Departmental and bureau management
Many of the improvements to Department operations and programs come through recommendations made in various OIG work
products. A measure of the OIG’s effectiveness is the extent to which it offers useful, practical recommendations for improvements.
A measure of the usefulness and practicality of the OIG’s recommendations is the extent to which they are accepted by DM.
Data Source
Frequency
Data Storage
Internal Controls
Data Limitations
Actions to be Taken
OIG audit and inspection process
As conducted
OIG files
OIG review
None
Continue collecting the measure.
F Y 2 0 0 7 P E R F O R M A N C E A N D A C C O U N T A B I L I T Y R E P O R T
403