Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
Department stated that this proposal “has a high risk of creating serious denial-of-service
issues and as such, itself poses risks to the security of the Department.”
OIG Analysis: OIG considers this recommendation unresolved. The testing that was
performed during the evaluation was a control-based test of the IA Training Plan, which
states, “First time users must complete the course within 2 weeks of being granted access
to the system. Thereafter, annual refresher training is required. Users should take the
course within ten working days of the expiration of the course completion certificate
received the previous year.” This recommendation can be resolved when the Department
agrees to follow its internal procedures or change its procedures to train first-time users.
D. Plans of Action and Milestones Are Not Effective
The Department’s Plans of Action and Milestones (POA&M) process is not fully and
effectively implemented, and the program is not compliant with FISMA and OMB requirements.
The POA&M is used to assist agencies in identifying, assessing, prioritizing, and monitoring the
progress of corrective actions for security weaknesses found in programs and systems.
The Department had not implemented a POA&M process to address and resolve security
weaknesses identified on ClassNet GSS. For example, ClassNet security weaknesses identified
from contingency plan test results, recommendations from external auditors, and annual tests and
audits of security controls are not tracked in the enterprise POA&M database, as required by
OMB 15 and the Committee on National Security Systems (CNSS). 16 The Department did not
properly follow OMB and CNSS mandated guidance for the ClassNet GSS to address all
weaknesses identified by program reviews and evaluations. Not addressing security weakness
for national security systems is a vulnerability that threatens Department assets and the nation.
In addition, we found that the Department had not implemented corrective actions to
address the POA&M control weaknesses within the OpenNet GSS identified in OIG’s FY 2010
FISMA report. Specifically, the Department’s POA&M process and program had the following
control deficiencies:
� It did not consistently record essential resources to remediate and resolve security
weaknesses. According to OMB, 17 POA&Ms should include the estimated funding
resources required to resolve the weakness as well as the anticipated source of
funding.
� It did not accurately and timely update remediation schedules to reflect actual system
owners and others’ performance to resolve or mitigate control weaknesses. NIST SP
15
OMB Memorandum M-04-25, FY 2004 Reporting Instructions for the Federal Information Security Management
Act.
16
CNSS Policy No. 22, “Information Assurance Risk Management Policy for National Security Systems.” (Feb.
2009)
17
OMB Memorandum M-04-25.
15
UNCLASSIFIED