Independent Evaluation of the DNFSB’s Implementation of the Federal Information Security Modernization Act (FISMA) of 2014 for Fiscal Year 2020

Agency Response Dated February 27, 2025: The requested ISA is incorporated in DNFSB’s Enterprise Architecture that was published in December 2024. <br />
OIG Analysis: The OIG confirmed that the agency has defined an ISA in accordance with the Federal Enterprise Architecture Framework. Hence, this recommendation is now closed.<br />
<br />
Status: Open: Resolved. DNFSB has completed development of our Zero Trust Implementation Plan and is actively working towards its implementation. This plan is the equivalent of an Information Security Architecture. Based on actions already taken, DNFSB’s position is that this Recommendation needs to be closed

OIG Analysis: The agency did not provide an updated response pertaining to Recommendation 2a and 2b.<br />
On September 20, 2023, the agency provided the following response:<br />
a. DNFSB is currently contracting with an outside consultant to develop an Enterprise Risk Management (ERM) Program and process, which will assess risk at the enterprise level. DNFSB’s existing Executive Committee on Internal Controls (ECIC) assesses risk at the business process level, and DNFSB’s existing Risk Management Framework handbook, configuration management, and continuous monitoring processes assess risk at the information system level.<br />
b. Risk tolerance, risk profiles and a risk register will be established as part of DNFSB’s ERM program. Risks from the information system level will flow up to the business process level, and risks at the business process level will flow up to the enterprise level to allow management to make more informed risk management decisions.<br />
The DNFSB met with the OIG on February 26th, 2025, to discuss potential corrective actions for Recommendation 2c <br />
and 2d. It was determined that the OIG will verify if corrective actions have been taken by the DNFSB to address<br />
Recommendation 2 during its FY25 Federal Information Security Modernization Act of 2014 (FISMA) audit.<br />
<br />
Status: Open: Resolved. 2.a. DNFSB is currently contracting with an outside consultant to develop an Enterprise Risk Management (ERM) Program and process, which will assess risk at the enterprise level. DNFSB’s existing Executive Committee on Internal Controls (ECIC) assesses risk at the business process level, and DNFSB’s existing Risk Management Framework handbook, configuration management, and continuous monitoring processes assess risk at the information system level.<br />
2.b. Risk tolerance, risk profiles and a risk register will be established as part of DNFSB’s ERM program. Risks from the information system level will flow up to the business process level, and risks at the business process level will flow up to the enterprise level to allow management make more informed risk management decisions. No target date for all four parts.<br />
2.c. DNFSB will conduct an organization wide security and privacy risk assessment once the ERM program has been established.<br />
2.d. DNFSB will conduct a supply chain risk assessment in Q2 FY2024.<br />

OIG Analysis: The agency did not provide an updated response pertaining to Recommendation 3b and 3d. On September 20, 2023, the agency provided the following response:<br />
a. DNFSB is currently contracting with an outside consultant to develop an Enterprise Risk Management Program and a process in accordance with recommendation 2020-2. Once complete, DNFSB can begin working on this recommendation.<br />
b. DNFSB will review existing policies &amp; procedures against the recommendation in NIST SP-800 55 Rev.2 and make any updates by Q2 FY 2024.<br />
d. DNFSB will update its Risk Management Framework Handbook and its and Continuous Monitoring Policies &amp;<br />
Procedures Guide to include prioritization of vulnerabilities based on severity level by Q2 FY 2024. The DNFSB met with the OIG on February 26th, 2025, to discuss potential corrective actions for Recommendation 3a and 3c. It was determined that the OIG will verify if corrective actions have been taken by the DNFSB to address Recommendation 3a through 3d during its FY25 FISMA audit.<br />
<br />
Status: Open: Resolved. DNFSB is currently contracting with an outside consultant to develop an Enterprise Risk Management Program and process in accordance with recommendation 2020-2. Once complete, DNFSB can begin working on this recommendation.<br />
3.a. DNFSB seeks clarification from the OIG of the specific actions that are required to resolve this portion of the Recommendation.<br />
3.b. DNFSB will review existing policies &amp; procedures against the recommendations in NIST SP-800 55 Rev.2 and make any updates by Q2 FY2024.<br />
3.c. DNFSB is currently contracting with an outside consultant to develop an Enterprise Risk Management (ERM) Program and process, which will assess risk at the enterprise level. DNFSB’s existing Executive Committee on Internal Controls (ECIC) assesses risk at the business process level, and DNFSB’s existing Risk Management Framework handbook, configuration management, and continuous monitoring processes assess risk at the information system level.<br />
3.d. DNFSB will update its Risk Management Framework Handbook and its and Continuous Monitoring Policies &amp; Procedures Guide to include prioritization of vulnerabilities based on severity level by Q2 FY2024.<br />

Status: Open: Resolved. DNFSB has implemented Qualys, Intune, and Microsoft Defender as hardware/software monitoring platforms. These systems have dashboards which provide a near real time view of hardware and software on the network. Track-It! and KACE have been implemented and their configurations are refined as needed. Device compliance policies, enforced by Microsoft Intune, identify devices (Agency laptops and iPhones) that are not running the current versions of Operating Systems. Only iPhones purchased through Apple Business Manager (formerly DEP) program can be enrolled in Intune, so no unauthorized mobile hardware can connect to DNFSB’s IT resources (no BYOD devices allowed). Users cannot install unauthorized software (all software on iPhones must be approved and installed through Intune; users cannot access the Apple App Store).<br />
Based on actions already taken, DNFSB’s position is that this Recommendation needs to be closed.<br />