FY2017 PROPOSED BUDGET

Washington Metropolitan Area Transit Authority
Proposed FY2017 Budget
Chapter 3
their own IT environment for vulnerabilities and increases awareness and minimize our risk
profile. Automated scan schedules for systems have been initiated which evaluate vulnerabilities
as well as patching on a monthly and quarterly basis, as defined for each type of system. CIS
benchmarks have been created for WMATA databases and continue to be the benchmarks for all
system types throughout the WMATA’s Vulnerability Management Program.
WMATA completed another successful PCI DSS project that lead to receiving another year of
compliance. MITS successfully implemented new, repeatable processes, for collecting artifacts
and answering the call of compliance which has reduced time to completion. Additionally, MITS
submitted a complete process package to help the authority in achieving our ISO-9000
certification. The package is to be used as a template for how to execute a complete process.
The Risk and Compliance department continues to execute and offer support with various audits
to include the FTA, FMO and OIG. Currently MITS is involved with answering the call to
complete the OIG audit on Oracle Databases. MITS created standardized processes for database
security configurations and procedures for database scanning. MITS has also executed an outreach
effort to our counterparts to make them aware of the standardization and assist with efforts to
classify their data. In the past 12 months we have established a process of performing risk
assessment for IT projects and compliance review which includes documented procedures and
forms for performing various risk assessments.
Supported multiple WMATA Bus & Rail projects for initial risk assessment to include Metro
Network extension to Van Buren office, extension of WMATA network to Dulles trailer, and Bus
Traffic Signal Prioritization.
III-80