FY 2018 Independent Evaluation of the NCUA's Compliance with FISMA 2014

Submitting OIG:

National Credit Union Administration OIG

Report Description:

The Office of Inspector General for the National Credit Union Administration (NCUA) engaged CliftonLarsonAllen LLP (CLA) to independently evaluate the NCUA's information security and privacy management programs and controls for compliance with the Federal Info1mation Security Modernization Act of 2014 and federal regulations and standards. CLA evaluated the NCUA's information security and privacy management programs through interviews, documentation reviews, technical configuration reviews, and sample testing. This year, CLA also conducted a vulnerability assessment of NCUA's network.

Short / Alternative Report Title:

NCUA OIG FY 2018 FISMA Report

Date Issued:

Wednesday, October 31, 2018

Agency Reviewed / Investigated:

National Credit Union Administration

Submitting OIG-Specific Report Number:

OIG-18-07

Location(s):

Agency-Wide

Type of Report:

Inspection / Evaluation

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

View Document:

Attachment	Size
ncua-oig-1807-compliance-fisma-2018.pdf	1.2 MB

Additional Details Link:

https://www.ncua.gov/About/Pages/inspector-general/audit-reports/Documents/oig-a…

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation
8. OIG-18-07 Recommendation	Open	Yes
The Office of the Chief Information Officer enforce the policy to remediate patch and configuration related vulnerabilities within agency defined timeframes.
9. OIG-18-07 Recommendation	Open	No
The Office of the Chief Information Officer implement a process to detect and migrate unsupported software to supported platforms before support for the software ends.
10. OIG-18-07 Recommendation	Open	No
The Office of the Chief Information Officer implement a process to identify authorized software in its environment and remove any unauthorized software.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

8. OIG-18-07 Recommendation

Open

Yes

The Office of the Chief Information Officer enforce the policy to remediate patch and configuration related vulnerabilities within agency defined timeframes.

9. OIG-18-07 Recommendation

Open

The Office of the Chief Information Officer implement a process to detect and migrate unsupported software to supported platforms before support for the software ends.

10. OIG-18-07 Recommendation