Report Summary

Each year agency program officials, chief information officers, and inspectors general must review their agencies’ information security programs and report to the Department of Homeland Security and Congress on the programs’ compliance with the Federal Information Security Modernization Act (FISMA). The OIG contracted with an independent public accounting firm CliftonLarsonAllen LLP (CLA) to evaluate VA’s information security program for FY 2022. After evaluating 47 major applications and general support systems hosted at 23 VA sites and on the VA Enterprise Cloud, CLA concluded that VA continues to face significant challenges meeting FISMA requirements. The audit found continuing significant deficiencies related to access, configuration management, and change management controls, as well as service continuity practices, all of which are designed to protect mission-critical systems from unauthorized access, alteration, or destruction. These deficiencies can be remedied by improving the deployment of security patches, system upgrades, and system configurations to mitigate significant security vulnerabilities; enforcing a consistent process across all field offices and improve performance monitoring to ensure controls operate as intended at all facilities and communicate identified security deficiencies to mitigate significant risks; and addressing security-related issues that contributed to the information technology material weakness reported in the FY 2022 audit of VA’s consolidated financial statements. VA concurred with CLA’s 26 recommendations, some of which addressed repeat deficiencies from previous FISMA reports spanning multiple years. CLA will follow up on the outstanding recommendations and evaluate the adequacy of corrective actions in the FY 2023 audit of VA’s information security program.