Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
Federal Information Systems and SP 800-53, Revision 3, Recommended Security
Controls for Federal Information Systems and Organizations, we recommend that the
Chief Information Officer:
� Revise the Information Resource Management/ Information Assurance
Contingency Plan Test Review checklist to address the following items:
o Recovery and damage assessment procedures
o Alternate recovery site details
o Back-up procedures
o Back-up test results for moderate- and high-impact systems
� Revise the Contingency Plan Policy to include an organization-defined
frequency for backup testing.
� Revise the Foreign Affairs Manual to require system owners to report to
IRM/IA on the test results and updates to the contingency plans.
Recommendation 16. We recommend that the Chief Information Officer in
accordance with the Foreign Affairs Manual (5 FAM 1065.3) and the National Institute
of Standards and Technology Special Publication 800-47, Security Guide for
Interconnecting Information Technology Systems, take the following actions:
� Ensure that the contractor oversight program complies with Office of Management
and Budget, Federal Information Security Management Act, National Institute of
Standards and Technology, and the Foreign Affairs Manual security policies,
standards, and requirements for managing Contractor Owned Contractor Operated
(COCO) systems; specifically, all security-related documentation for such systems
should be retained.
� Implement a COCO system security program whereby COCOs are overseen by the
Bureau of Information Resource Management/ Information Assurance.
Recommendation 17. We recommend that the Bureau of Diplomatic Security develop
and implement new and enhanced security requirements to coordinate security
activities for tracking all extensions (that is, contractor sites, other Government
agencies, and third-party vendors) to OpenNet and ClassNet as required by the Office
of Management and Budget Memorandum M-11-33, FY 2011 Reporting Instructions
for the Federal Information Security Management Act and Agency Privacy
Management.
Recommendation 18. We recommend that the Bureau of Diplomatic Security, in
coordination with the Bureau of Administration, establish procedures to identify the
total number of contractors who have access to Department of State systems, as
39
UNCLASSIFIED