Stay Informed
of New Reports
Twitter
Where To Report Waste
Fraud, Abuse, Or Retaliation
Where To Report Waste Fraud, Abuse, Or Retaliation

Audit of Protection of DoD Controlled Unclassified Information on Contractor-Owned Networks and Systems

Submitting OIG: 
Department of Defense OIG
Date Issued: 
Thursday, July 25, 2019
Agency Reviewed / Investigated: 
Department of Defense
Submitting OIG-Specific Report Number: 
DODIG-2019-105
Component, if applicable: 
Defense Contract Management Agency (DCMA)
Defense Threat Reduction Agency (DTRA)
Missile Defense Agency (MDA)
OSD Chief Information Officer (CIO)
OSD Director of Operational Test and Evaluation (DOT&E)
United States Air Force (USAF)
United States Army (USA)
United States Cyber Command (USCYBERCOM)
United States Navy (USN)
United States Transportation Command (USTRANSCOM)
Location(s): 
Agency-Wide
Type of Report: 
Audit
Questioned Costs: 
$0
Funds for Better Use: 
$0
Number of Recommendations: 
2
View Document: 
AttachmentSize
PDF icon DODIG-2019-105.pdf15.18 MB

Related Open Recommendations

Recommendation Number Recommendation Status Significant Recommendation Additional Details
D-2019-0105-D000CR-0001-0001.A1a Open No
Rec. A.1.a: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with Defense Pricing and Contracting, implement or revise policy to require all systems and networks that maintain DoD information, including those owned by contractors that maintain DoD information, to use strong passwords that, at a minimum, meet DoD password length and complexity requirements.
D-2019-0105-D000CR-0001-0001.A1b Open No
Rec. A.1.b: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with Defense Pricing and Contracting, implement or revise policy to require all systems and networks that maintain DoD information, including those owned by contractors that maintain DoD information, to configure their systems and networks to align with DoD requirements for locking after 15 minutes of inactivity and 3 unsuccessful logon attempts.
D-2019-0105-D000CR-0001-0002.A2ae Open No
Rec. A.2.a-e: The DoD OIG recommended that the Principal Director for Defense Pricing and Contracting, in coordination with the appropriate DoD Component responsible for developing policy: a. revise its current policy to require DoD Component contracting offices, as part of the Request for Proposal and source selection processes, and requiring activities, during the performance of the contract, to assess whether contractors comply with the National Institute of Standards and Technology requirements for protecting controlled unclassified information before contract award and throughout the contracts' period of performance. b. develop and implement policy requiring DoD Component contracting offices and requiring activities to maintain an accurate accounting of contractors that access, maintain, or develop controlled unclassified information as part of their contractual obligations. c. revise its current policy to include language that will require DoD Component contracting offices and requiring activities to validate contractor compliance with National Institute of Standards and Technology Special Publication 800-171 requirements. d. require DoD Component contracting offices, in coordination with DoD requiring activities, to develop and implement a risk-based process to verify that contractors comply with the Defense Federal Acquisition Regulation Supplement clause 252.204-7012 for protecting controlled unclassified information. e. require DoD Component contracting offices, in coordination with DoD requiring activities, to take corrective actions against contractors that fail to meet the National Institute of Standards and Technology and contract requirements for protecting controlled unclassified information.
Displaying 3 of 3 Recommendations