Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
UNCLASSIFIED
12
The Department will verify that all Department of State computers at other Federal
agencies are clearly documented. (We found no defects with regard to the process for
contractor sites.)
Recommendation 18: {Section J} We recommend that the Bureau of Diplomatic Security, in
coordination with the Bureau of Administration, establish procedures to identify the total number
of contractors who have access to Department of State systems as required by the Office of
Management and Budget Memorandum M-11-33, FY 2011Reporting Instructionsfor the
Federal Information Security Management Act and Agency Privacy Management.
Department Response to Recommendation 18:
The Department does not agree with this recommendation because a) knowing the exact
total number of contractors (a continuously changing number) does not have an impact
upon the security of the Department, and b) it is not required by M-1l-33.
Recommendation 19: {Section K} We recommend that the Chief Information Officer, as
required by Office of Management and Budget (OM B) Memorandum M-11-33, FY 2011
Reporting Instructions for the Federal Information Security Management Act and Agency
Privacy Management and OMB Circular No. A-II, Preparation, Submission, and Execution of
the Budget:
• Ensure that the Bureau of Information Resource Management/ Business Management and
Planning track all obligations and expenditures for information technology security
investments.
• Provide a summary of non-maj or investments that make up the information technologyinfrastructure
and other major investments.
• Include the Unique Project Identifier in the Department of State's Plans of Action and
Milestones database.
Department Response to Recommendation 19:
The Department agrees with the recommendation, but not the authorities cited and will:
• Track and include a summary report for all obligations and expenditures for all IT
projects with a) a material level offunding, or b) significant security risk.
• Include UP Is in the Department's POA&M for each system.
73
UNCLASSIFIED