Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
Department’s risk management strategy addresses how the Department will assess,
respond to, and monitor information security risk.
Recommendation 3. We recommend that the Chief Information Officer:
� Improve oversight of the security assessment and authorization process for
the Department’s information systems, especially the OpenNet General
Support System (GSS) and ClassNet GSS as required by the National
Institute of Standards and Technology (NIST) Special Publication (SP)
800-37.
� Improve existing procedures to ensure security authorization packages are
updated every 3 years or when a significant change occurs or develop a
risk-based approach for implementing a continuous monitoring strategy as
required by NIST SP 800-37.
� Improve existing procedures to ensure Systems Security Plans and Systems
Assessment Reports are updated as required to comply with the security
baseline controls contained in NIST SP 800-53 (Revision 3).
� Perform annual security assessments of a subset of a system’s security
controls as required by NIST SP 800-37.
Management Response: The Department did not agree with the recommendation,
stating that based on OMB Memorandum M-11-33, security reauthorizations are not
required every 3 years but through “ongoing authorizations” via implementation of a
continuous monitoring program. The Department also did not agree that security
assessments and authorizations had to be improved, stating that NIST SP 800-53
guidance “was not fully implemented until June 2010.” The Department also stated that a
“new NIST 800-53A was needed to implement the new 800-53, and was not published
until June 2010.” Therefore, according to the Department, “compliance was not required
for C&As starting before June 2011” but, as of June 2011, the Department “will comply
with the new version of NIST 800-53/53A.” The Department further stated that its C&A
Toolkit “has been fully updated to implement this change” and that it “performs such
annual testing on all its systems, except in rare cases that are vigorously pursued.”
OIG Analysis: OIG considers this recommendation unresolved. The evaluation of the
Department’s continuous monitoring program determined that several control
deficiencies were identified (see Appendix H), therefore weakening the reliance on the
continuous monitoring program. NIST SP 800-53, Revision 3, guidance was issued in
August 2009, and OMB Memorandum M-11-33 states that “agencies are expected to be
in compliance with NIST standards and guidelines within one year of the publication date
unless otherwise directed by OMB.” Although the Department stated that it had
performed annual security assessments on all of its controls, testing results showed that
the Department was not testing all of the security controls and could not support the
control baselines necessary to define the testing level. This recommendation can be
considered resolved when OIG reviews and accepts documentation showing that the
Department has agreed to address these risk management recommendations and the
actions it will take to address these actions.
10
UNCLASSIFIED