U.S. flag

An official website of the United States government

Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock () or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

U.S. Department of Agriculture, Office of the Chief Information Officer, Fiscal Year 2024 Federal Information Security Modernization Act

Report Information

Date Issued
Report Number:
50503-0013-12
Report Type
Audit
Description
As required by FISMA, OIG reviewed USDA’s ongoing efforts to improve its information technology security program and practices during FY 2024.
Joint Report
Yes
Participating OIG
Department of Agriculture OIG
Agency Wide
Yes (agency-wide)
Questioned Costs
$0
Funds for Better Use
$0
View report on Oversight.gov

Recommendations

We recommend Departmental Administration Information Technology Office management enforce multi-factor authentication, or the equivalent thereof, to the application.

We recommend (REDACTED) management implement a system of quality control to ensure the timely completion of quarterly privileged user access reviews in accordance with USDA Departmental Regulation 3505-003.

We recommend that Departmental Administration Information Technology Office management develop, document, and implement a control to monitor the assigned organization security coordinators complete privileged user access reviews in a timely manner.

We recommend Departmental Administration Information Technology Office management configure the system to generate user listings with the required data elements (e.g., first name, last name, account creation date, and roles or privileges) to support its system of internal controls and operational needs.

We recommend Departmental Administration Information Technology Office management provide training to personnel supporting the application on system administration including their responsibilities in supporting access controls, audits, and assessments.