Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
Management Comments: The Department stated that it “agrees some increased level of
documentation,” as was recommended, “would be valuable.”
OIG Analysis: OIG considers this recommendation resolved. The recommendation can
be closed when OIG reviews and accepts documentation showing that the ISSC has
developed, documented, and implemented an enterprise-wide continuous monitoring
strategy.
Recommendation 11. We recommend that the Chief Information Officer in
accordance with the requirements in NIST SP 800-39, Managing Information
Security Risk:
� Implement a continuous monitoring strategy at the enterprise-wide level.
� Obtain and use scanning software to enable effective scans of non-
Windows operating systems, databases, firewalls, routers, and switches.
� Develop operating procedures to ensure the results are included in the Risk
Scoring Program dashboard.
� Develop procedures to ensure that System Security Owners update the
system security plans to include a continuous monitoring strategy to detail
how system security controls are to be monitored.
Management Response: The Department stated that it is “already engaged in” efforts
pertaining to the scanning software, that it will “pursue [these efforts] with an appropriate
level of priority,” that it “will expand the coverage of the risk scoring program,” and that
it “will continue to expand coverage of risk in iPost.” As far as documenting a strategy in
its security plans, the Department stated that “the continuous monitoring strategy is an
enterprise level strategy” and therefore “does not need to be addressed in detail in every
system security plan.”
Regarding implementation of a continuous monitoring strategy at the enterprise-wide
level, the Department stated that this implementation “will require continuous
improvement and thus never be completed” and that its “current continuous monitoring
implementation is being copied as a model by other government agencies and the private
sector.”
OIG Analysis: OIG considers this recommendation unresolved. Although OIG is aware
that the Department has received nation-wide recognition for its continuous monitoring
program, the Department must document a continuous monitoring strategy in every
security plan, as required by NIST.
Furthermore, in its response to the Government Accountability Office’s July 2011 report
on information security, 34 the Department responded as follows: “State officials
34
Information Security: State Has Taken Steps to Implement a Continuous Monitoring Application, but Key
Challenges Remain (GAO 11-49, July 2011).
23
UNCLASSIFIED