EPA’s Emergency Response Systems at Risk of Having Inadequate Security Controls

Submitting OIG:

Report Description:

See the additional details link below for the full report, report summary, multimedia or any agency follow-up.

Date Issued:

Monday, September 13, 2021

Agency Reviewed / Investigated:

Submitting OIG-Specific Report Number:

21-E-0226

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

View Document:

Attachment	Size
oversightgovEPA-OIG2021-09-1321-E-0226.pdf	1.19 MB

Additional Details Link:

Recommendation Number	Recommendation Status	Significant Recommendation	Additional Details
21-E-0226_1	Open	No
Implement controls to follow National Institute of Standards and Technology guidance when conducting systems categorizations by: a. Involving the appropriate key stakeholders, including mission owners and the chief information security officer, during the system security categorization process as prescribed in the National Institute for Standards and Technology Special Publication 800-60 Volume I, Table 3, Process Roadmap. b. Having responsible parties adhere to all activity steps as outlined in the National Institute for Standards and Technology Process Roadmap, including selecting all application information types applicable to information systems. c. Having responsible parties document the security categorization determinations and decisions within system security plans as provided in the National Institute for Standards and Technology Process Roadmap, including documenting all downward adjustments to provisional security levels.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

21-E-0226_1

Open

Search form