Where To Report Waste

Fraud, Abuse, Or Retaliation

Alabama MMIS and E&E System Security Controls Were Adequate, but Some Improvements Are Needed

Submitting OIG:

Department of Health & Human Services OIG

Date Issued:

Tuesday, April 23, 2024

Agency Reviewed / Investigated:

Department of Health & Human Services

Submitting OIG-Specific Report Number:

A-18-22-09010

Component, if applicable:

Centers for Medicare & Medicaid Services

Location(s):

AL

United States

Type of Report:

Audit

Questioned Costs:

$0

Funds for Better Use:

$0

Number of Recommendations:

5

Report updated under NDAA 5274:

No

Additional Details Link:

https://oig.hhs.gov/oas/reports/region18/182209010.asp

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation	Additional Details
24-A-18-056.01	Open	No
We recommend that the Alabama Medicaid Agency remediate the six control findings OIG identified.
24-A-18-056.02	Open	No
We recommend Alabama evaluate its current vulnerability scanning tools and update if necessary in order to better detect system flaws (e.g., common web server vulnerabilities) in its MMIS and E&E system and software components.
24-A-18-056.03	Open	No
We recommend Alabama require its developers to follow secure coding standards and best practices, at a minimum, such as those recommended by NIST SP 800-218 or the Open Web Application Security Project (OWASP), when developing web applications.
24-A-18-056.04	Open	No
We recommend Alabama implement procedures to periodically verify that its developers are adhering to secure coding standards and remediating vulnerabilities before releasing code to production.
24-A-18-056.05	Open	No
We recommend Alabama perform more robust technical testing of web-facing systems that includes the emulation of an adversary's tactics and techniques on a defined reoccurring basis in order to better assess the effectiveness of NIST 800-53 controls.