IG flags Commerce security problems

The department must improve its handling of sensitive data and revisit key systems previously certified as secure, according to the inspector general

Information security is the Commerce Department's no. 1 challenge in this fiscal year, according to its inspector general.

In its semiannual report to Congress for the six months ending Sept. 30, the IG cited the department's poor track record with regard to protecting the privacy of personal data and its slow progress on certifying the security of its critical systems.

The privacy concerns stem from a late September study that found the department had lost 1,137 laptop computers and other mobile devices since 2001, 249 of which contained personally identifiable information (PII).

Under guidelines that the Office of Management and Budget issued, agencies must take several steps to protect personal data. To start, they should encrypt all sensitive data stored on mobile devices. They also must incorporate two kinds of authentication -- such as passwords and fingerprints -- to control remote access to systems with sensitive data. Finally, they should set up their systems to disconnect users who have been logged on for too long without any activity, and they should log all activity on those systems.

It was unclear whether Commerce had followed those guidelines, the IG reported.

“We found that in most cases bureaus could not demonstrate that the necessary steps have been taken to ensure that PII is adequately safeguarded,” the report stated. “None of the system documentation reviewed indicated that PII was stored or processed, a step needed to determine the required safeguards.”

The IG also criticized the department for the mixed results of its efforts to certify and accredit the security of important systems. Commerce officials appear to have made some progress, completing the process for 22 of its 28 systems by August 2006 –- an increase from only five a year earlier.

In evaluating the certification and accreditation documentation, the IG found that only a third of the systems fully complied with the security standards that the National Institute of Standards and Technology set, and nine of the remaining systems had serious deficiencies.


  • Veterans Affairs
    Veterans Affairs CIO Jim Gfrerer speaks at an Oct. 10 FCW event (Photo credit: Troy K. Schneider)

    VA's pivot to agile

    With 10 months on the job, Veterans Affairs CIO Jim Gfrerer is pushing his organization toward a culture of constant delivery.

  • Defense
    Dana Deasy, DOD Chief Information Officer, hosts a roundtable discussion on the enterprise cloud initiative with reporters, Aug. 9, 2019, at the Pentagon, Washington, D.C. (DoD photo by Air Force Staff Sgt. Andrew Carroll)

    DOD CIO 'very confident' that White House influence didn't guide JEDI award

    At his Senate confirmation hearing, Defense Department CIO Dana Deasy said the department's $10 billion cloud contract was awarded by a team of experts.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.