Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
Appendix B. Followup of Recommendations From the FY 2010 FISMA
Report
The evaluation team reviewed actions implemented by management to mitigate the
findings identified in the FY 2010 FISMA report. The current status of each of the
recommendations is as follows:
Recommendation 1. We recommend that the Chief Information Officer verify the Federal
Information Security Management Act systems inventory list to the Information Technology
Asset Baseline to ensure that all information technology systems are accurately accounted for.
2011 Status: Closed. We reviewed the population of the FY 2010 fourth quarter FISMA
inventory list and the population of the FY 2011 third quarter FISMA inventory list. We verified
all changes between the two populations within ITAB. The list was accurate and complete.
Recommendation 2. We recommend that the Chief Information Security Officer ensure that
systems operated by a contractor, including systems rated low cost and low impact, the security
authorization process, including completion of a risk assessment and implementation of
necessary security controls, and that security authorization packages are completed on a timely
basis.
2011 Status: This recommendation is partially closed. The systems rated low cost and low
impact that are operated by contractors are websites hosted on foreign Internet Service
Providers (ISPs). The Department cannot enforce FISMA/NIST requirements for websites hosted
on foreign ISPs, as FISMA and NIST are US law/standards. The evaluation found that security
authorization packages were not completed accurately and on a timely basis. It has become
Recommendation 3 (Finding A) in the FY 2011 report.
Recommendation 3. We recommend that the Chief Information Officer develop a process to
periodically update the resources recorded in the plans of action and milestones (POA&M) and
that it update, in the POA&Ms, those completion dates for corrective actions that have expired.
2011 Status: This is open and a repeat recommendation from the FY 2010 report. It has become
Recommendation 7 (Finding D) in the FY 2011 report
Recommendation 4. We recommend that the Chief Information Officer, the Foreign Service
Institute, and the Bureau of Diplomatic Security implement methods to enforce the security
awareness policy to suspend a user’s access if the user has not taken the Cyber Security
Awareness course within the required timeframe.
2011 Status: This is open and a repeat recommendation from the FY 2010 report. It has
become Recommendation 6 (Finding C) in the FY 2011report.
44
UNCLASSIFIED