Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
� One system–State Messaging and Archive Retrieval Toolset (SMART) -
Classified system–did not have a CP. The FAM 40 states that system owners
and non-Department entities are required to develop and maintain
contingency plans for the major applications and general support systems
under their control that process, store, or transmit Federal information.
� Two systems–eCountryClearance (eCC) and Secure Integrated Logistics
Management System (S-ILMS)–CPs were not sufficiently detailed to
enable the proper recovery and damage assessment. NIST SP 800-34,
Revision 1, 41 requires the agency to address specific actions the
organization should take following a system disruption or an emergency.
Plans should be formatted to provide quick and clear directions in the event
that personnel unfamiliar with the plan or the systems are called upon to
perform recovery operations.
� Fifteen systems did not document the annual backup test, as required by
NIST 42 for moderate- and high-impact systems, to verify media reliability
and information integrity. (Systems that did not have annual backup testing
are described in Appendix F).
� Three systems–OpenNet, WebPass, and TDS–had not documented backup
procedures.
The control deficiencies occurred within the contingency planning program because the
Department relies extensively on the system owners and bureaus to execute the Department’s
policies, establish and implement internal procedures, and ensure compliance with NIST SP 800-
34, Revision 1.
Additionally, the Department had not developed reporting requirements for obtaining
assurance of performance from the system owners and bureaus. By inadequately documenting
the contingency plan, there is an increased risk that the Department will not be able to recover its
mission-critical systems timely in the event of a significant disruption. Also, the Department
increases the risks that it will not be able to meet its mission requirements and continue normal
business activities.
Recommendation 14. As required by National Institute of Standards and Technology
(NIST) Special Publications (SP) 800-34, Revision 1, Contingency Planning Guide for
Federal Information Systems, and SP 800-53, Revision 3, Recommended Security
Controls for Federal Information Systems and Organizations, we recommend that the
Bureau of Information Resource Management, Office of Information Assurance, in
coordination with the bureaus and system owners, take the following actions:
40
5 FAM 1064.2(a)(1).
41
NIST SP 800-34, rev. 1, Contingency Planning Guide for Federal Information Systems (May 2010) (last updated
Nov. 11, 2010).
42
NIST SP 800-53, rev. 3, Recommended Security Controls for Federal Information Systems and Organizations
(Aug 2009).
27
UNCLASSIFIED