Where To Report Waste

Fraud, Abuse, Or Retaliation

Administration for Children and Families Data Hosted in Certain Cloud Information Systems May Be at a High Risk of Compromise

Submitting OIG:

Department of Health & Human Services OIG

Date Issued:

Tuesday, April 23, 2024

Agency Reviewed / Investigated:

Department of Health & Human Services

Submitting OIG-Specific Report Number:

A-18-22-08020

Component, if applicable:

Administration for Children and Families

Location(s):

United States

Type of Report:

Audit

Questioned Costs:

$0

Funds for Better Use:

$0

Number of Recommendations:

5

Report updated under NDAA 5274:

No

View Document:

Attachment	Size
Amdin-CHildren-and-Families.pdf	1.39 MB

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation	Additional Details
24-A-18-057.01	Open	No
We recommend ACF update and maintain a complete and accurate inventory of information systems hosted in the cloud.
24-A-18-057.02	Open	No
We reccomend ACF remediate the 19 security control findings in accordance with NIST SP 800-53.
24-A-18-057.03	Open	No
We recommend ACF update its cloud security procedures to include detailed steps for operational staff to effectively implement cloud security baselines in accordance with HHS requirements.
24-A-18-057.04	Open	No
We reccomend ACF leverage cloud security assessment tools to identify misconfigurations and weak cybersecurity controls in its cloud infrastructure.
24-A-18-057.05	Open	No
We recommend ACF conduct testing of its cloud information systems that includes the emulation of an adversary's tactics and techniques on a defined reoccurring basis.