USPTO Performance and Accountability Report - U.S. Patent and ...

On the basis of the USPTO’s comprehensive
internal control program during
FY 2012, the USPTO can provide
reasonable assurance that its internal control
over the effectiveness and efficiency of operations
and compliance with applicable laws
and regulations as of September 30, 2012, was
operating effectively. Accordingly, I am pleased
to certify with reasonable assurance that our
agency’s systems of internal control, taken as a
whole, comply with Section 2 of the Federal
Managers’ Financial Integrity Act of 1982.
Our agency also is in substantial compliance
with applicable federal accounting standards
and the U.S. Standard General Ledger at the
transaction level and with federal financial
system requirements. Accordingly, our agency
fully complies with Section 4 of the Federal
Managers’ Financial Integrity Act of 1982, with
no material non-conformances.
In addition, the USPTO conducted its assessment
of the effectiveness of our agency’s
internal control over financial reporting, which
includes safeguarding of assets and compliance
with applicable laws and regulations, in
accordance with OMB Circular A-123, Management’s
Responsibility for Internal Control. Based
on the results of this evaluation, the USPTO
provides reasonable assurance that its internal
control over financial reporting as of June 30,
2012 was operating effectively and no material
weaknesses were found in the design or
operation of the internal control over financial
reporting. In addition, no material weaknesses
related to internal control over financial
reporting were identified between July 1, 2012
and September 30, 2012.
David J. Kappos
Under Secretary of Commerce for Intellectual
Property and Director of the United States
Patent and Trademark Office
November 7, 2012
MANAGEMENT’S DISCUSSION AND ANALYSIS
effective internal control, and comply with legal and
regulatory requirements. The USPTO complied
substantially with the FFMIA for FY 2012.
Other Compliance with Laws
and Regulations
Federal Information Security Management Act
The USPTO continues to stay vigilant in reviewing
administrative controls over information systems and
is always seeking methods of improving our security
program. During FY 2012, the USPTO continued its
dedicated efforts in support of compliance with
FISMA standards and improvement of our security
program. The USPTO IT Security Program includes a
strategy for continuous monitoring, which conducts
credentialed compliance and vulnerability scans
on servers, network devices, database, and Web-application
on a quarterly basis. The analysis is being
performed to ensure that operating systems have
been configured in accordance with their security
baseline and appropriate software patch levels.
Additionally, the IT Security program has integrated
artifacts to support Security Impact Analysis within
the systems development lifecycle that allow assessment
of testing requirements for systems undergoing
new developments, enhancements, or maintenance.
This proactive approach to security within
the development process has successfully assessed
changes and enabled security compliance for
systems as they are being developed or updated.
As a result, the Chief Information Security Officer
and the OCIO staff working together made a
concerted effort to meet the compliance requirements
of FISMA, while also meeting the reporting
requirements to OMB. These endeavors were a
complete success. All USPTO systems achieved a
100 percent FISMA compliance reporting level for
FY 2012. There were no deficiencies identified that
are considered to be the result of any material weaknesses
in internal control. As a result of the work
accomplished, the USPTO was able to continue with
continuous monitoring and provide an accurate
summary of information consistent with OMB
reporting requirements for year-end reporting.
www.uspto.gov
63