ALEXANDRIA, Va.—NCUA’s office of the Inspector General has released its review of the agency’s information security program, offering six recommendations for improvements.
The report (OIG-15-10) was conducted by CliftonLarsonAllen LLP to independently evaluate the effectiveness of NCUA’s information security program and practices as required by the Federal Information Security Modernization Act of 2014, and to assess NCUA’s privacy management program, the OIG stated.
The study revealed that in resolving prior year issues and recommendations, NCUA has continued to strengthen its information security program during fiscal year 2015. NCUA has also made progress in documenting its privacy program. NCUA does not have any repeat findings from prior years, the OIG said.
In addition to NCUA needing to continue to make improvements in its privacy management program, the OIG identified three information security program areas in which NCUA needs to make improvements: risk management programs, configuration management programs and authentication controls.
The OIG made six recommendations, which it said would help NCUA continue to improve the effectiveness of its information security program and its privacy management program (three of the recommendations are redacted):
-
That NCUA complete the process of assessing, documenting and communications the organization-wide risk tolerance guide.
-
That the senior agency official for privacy complete documentation and implementation of privacy policies and procedures in accordance with National Institute of Science and Technology (NIST) guidance.
- That the Office of the Chief Information Officer update the agency’s general support security plan to include control implementation descriptions for NIST privacy controls.
The complete report can be found here in CUToday.info’s The Gov.