Continue efforts to develop and implement role-based privacy training for users with significant privacy or data protection related duties.
Agency Response Dated June 2, 2025: As of June 2, 2025, DNFSB did not provide an updated response pertaining to recommendation 11. However, the agency provided an update to the target completion date. Estimated Target Completion Date: fiscal year (FY) 2025, Quarter 4<br />
OIG Analysis: The OIG will close this recommendation after confirming that the agency has continued its efforts to develop and implement role-based privacy training for users with significant privacy or data protection-related duties.<br />
<br />
March 31, 2025: Agency Status: In a February 26th, 2025, meeting between the DNFSB and OIG, the DNFSB noted that, “the DNFSB is currently in the process of developing role-based privacy training,” based on their testing.<br />
OIG Analysis: The DNFSB met with the OIG on February 26th, 2025, to discuss potential corrective actions for this recommendation. The OIG notified the DNFSB that, ultimately, the agency should define this themselves (i.e., who/what roles require additional privacy role-based training). Therefore, to close this recommendation, the DNFSB would need to demonstrate identification of the roles that are required to take additional privacy role-based training, show evidence of the development and/or acquisition/rollout of privacy rolebased training program materials, and show the<br />
implementation of the privacy role-based training (i.e., that the required personnel have taken the training). The OIG will verify if corrective actions have been taken by the DNFSB to address this recommendation during its FY25 FISMA audit.<br />
<br />
Status: Open: Resolved. DNFSB provides role-based privacy training within its required annual Cyber Awareness training. Topics such as Social Networking, handling of Controlled Unclassified Information (CUI) and Classified data, website use, and Social Engineering are all covered by this training. Each user is required to complete this training prior to accessing DNFSB systems. DNFSB further requires all users to take annual Controlled Unclassified Information (CUI) training, and all Federal employees with DOE clearances must take an annual clearance holder training, both of which address requirements for accessing, storing, and transmitting sensitive information. DNFSB has developed updated privacy training and will deliver it to agency users by the end of Q1 FY 2024. DNFSB needs the OIG to define which roles it feels require additional role-based privacy training in order to resolve this recommendation.
