Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
Awareness course within the required timeframe as required by the Information
Assurance Training Plan.
Recommendation 7. We recommend that the Chief Information Officer:
� Implement a Plans of Action and Milestones (POA&M) tracking process
for all ClassNet security weaknesses as required by Committee on National
Security Systems Policy Number 22, Information Assurance Risk
Management Policy for National Security Systems.
� Distribute the quarterly POA&M Grade Memorandums to the bureaus’ and
offices’ senior management (executive director) as required by M-04-25,
FY 2004 Reporting Instructions for the Federal Information Security
Management Act.
� Ensure that the POA&M completion dates and the required resources for
OpenNet corrective actions are updated as required by OMB Memorandum
M-04-25.
Recommendation 8. We recommend that the Chief Information Officer (CIO) develop and
implement Department of State processes and procedures to resolve weaknesses in user accounts
to ensure that unnecessary network user accounts are promptly removed by the bureaus and
posts. Further, the CIO should develop and implement procedures to ensure that bureaus and
organizational unit administrators annually review and recertify access privileges of users so that
the number of guest, test, and temporary accounts are managed effectively as required by the
Foreign Affairs Manual 12 FAM 622 and 12 FAM 629.
Recommendation 9. We recommend that the Chief Information Officer (CIO) ensure
compliance with the account management process to make certain that user and administrator
accounts are created, modified, and deleted in a manner consistent with Department of State
policy. Further, the CIO needs to compare the terminated user listings provided by bureau and
post personnel officers with information contained in the active directory on a quarterly basis to
ensure that accounts for separated employees are removed timely, as required by NIST SP 800-
53, Revision 3, August 2009, Recommended Security Controls for Federal Information Systems
and Organizations, and the Foreign Affairs Manual (12 FAM 621.3).
Recommendation 10. We recommend that the Information Security Steering Committee
develop, document, and implement an enterprise-wide continuous monitoring strategy that
addresses framing risk, assessing risk, responding to risk, and monitoring risk, as required by
NIST SP 800-39, “Managing Information Security Risk.”
Recommendation 11. We recommend that the Chief Information Officer in accordance with the
requirements in NIST SP 800-39, Managing Information Security Risk:
� Implement a continuous monitoring strategy at the enterprise-wide level.
� Obtain and use scanning software to enable effective scans of non-
Windows operating systems, databases, firewalls, routers, and switches.
37
UNCLASSIFIED