FISMA noncompliance leaves VA vulnerable

An inspector general audit has revealed that the Veterans Affairs Department’s failure to fully comply with the Federal Information Security Management Act has resulted in more than 15,000 outstanding security risks.

The fiscal year 2011 performance audit examined the extent to which VA’s information security program complied with FISMA requirements and applicable National Institute for Standards and Technology guidelines. Although VA has made progress in creating policies and procedures, certain practices fail to meet FISMA requirements.

Substantial inadequacies were discovered in areas related to access controls, configuration management controls, continuous monitoring, and services continuity practices. Also, VA hasn’t effectively implemented procedures to identify and remediate system security flaws on network devices, and database and server platforms and web applications.

Deficiencies were also found in VA’s reporting, managing, and closing plans of action and milestones (POA&M). More than 15,000 outstanding POA&M actions must be taken to remediate risks and beef up the agency’s information security posture, the IG said, or VA won’t be able to ensure the protection of its systems throughout their life cycle.

The IG report accentuated what has materialized as a larger compliance issue governmentwide. A March 7 review by the Office of Management and Budget showed that only seven out of 24 agencies are more than 90 percent compliant with FISMA directives.

About the Author

Camille Tuutti is a former FCW staff writer who covered federal oversight and the workforce.

Featured

  • Management
    people standing on keyboard (Who is Danny/Shutterstock.com)

    OPM-GSA merger plan detailed in legislative proposal

    The White House is proposing legislation for a dramatic overhaul of human resources inside government and wants $50 million to execute the plan.

  • Cloud
    cloud applications (chanpipat/Shutterstock.com)

    GSA plans civilian DEOS counterpart

    GSA is developing a cloud email and enterprise services contract inspired by the single-source vehicle the Department of Defense devised for back-office software.

  • Defense
    software (whiteMocca/Shutterstock.com)

    DOD looks to unify software spending for 2020

    Defense Department acquisition head, Ellen Lord, hopes to simplify software buying and improve business systems following the release of the Defense Innovation Board's final software acquisition study.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.