Exhibit I – Significant Deficiency

U.S. Department of Commerce
Independent Auditors' Report
Exhibit I – Significant Deficiency

Financial Management Systems Need Improvement (Repeat Condition Since 1998)

For many years, the U.S. Department of Commerce (the Department) Office of Inspector General (OIG), U.S. Government Accountability Office (GAO), and departmental selfassessments have identified weaknesses in the Department’s information technology (IT) and financial systems controls. As at many federal entities, information security is recognized as a top management challenge for the Department. During our fiscal year (FY) 2007 assessment of the Department’s general IT and financial systems controls, performed in support of the FY 2007 consolidated financial statement audit, we found that there is continued emphasis on the need for a strong certification and accreditation (C&A) program. We also noted that the bureaus and the Department took positive steps to implement management, operational, and technical controls to help establish sound information security practices and address known weaknesses, including an IT security material weakness reported under the Federal Managers’ Financial Integrity Act (FMFIA) in the prior year.

Despite continued progress, during our FY 2007 audit we identified weaknesses in general IT controls that we consider to be a significant deficiency as defined by the American Institute of Certified Public Accountants. As part of the Department’s FY 2007 FMFIA evaluation, the Department determined (and the OIG also confirmed) that a weakness, related to IT information security, still exists.

Effective general IT controls add assurance that data used to prepare and report financial information and statements is complete, reliable, and has integrity. Our FY 2007 IT assessment was focused on the general IT controls over the Department’s major financial management systems and supporting network infrastructure, using GAO’s Federal Information System Controls Audit Manual (FISCAM) as a guide. The six FISCAM general IT control review elements, and our related findings, are as follows:

• Entity-wide security program. An entity-wide security program for security planning and management is the foundation of an organization’s information security control structure. The program should provide a framework and continuing cycle of activity for managing risk, developing security policies, assigning responsibilities, and monitoring the adequacy of computer-related security controls.
  
  Although the Department has made improvements in this area, during our FY 2007 audit we identified that entity-wide security can still be improved at all bureaus, primarily in the areas of: (1) updating risk assessments, (2) finalizing C&As, (3) updating system security plans to comply with current Federal guidance, (4) improving incidence response procedures and training, (5) ensuring completion of initial security awareness and specialized training, (6) establishing a memorandum of understanding for shared financial data, and (7) obtaining executed non-disclosure agreements from contracted personnel.
  
  Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, provides key guidance for establishing and maintaining an entity-wide information security program. Collectively, the identified entity-wide security planning and management issues, coupled with the access control issues described below, reduce the overall effectiveness of the entity-wide security programs for the individual bureaus and operating units, and the overall Department. The Department of Commerce IT Security Program Policy and Minimum Implementation Standards, reiterates OMB Circular A-130 guidance, and implements key elements of such guidance as Department-wide policy.
• Security access controls. In close concert with an organization’s entity-wide information security program, access controls for general support systems and financial systems should provide reasonable assurance that computer resources such as data files, application programs, and computer-related facilities and equipment are protected against unauthorized modification, disclosure, loss, or impairment. Access controls are facilitated by an organization’s entity-wide security program. Such controls include physical controls and logical controls.
  
  The objectives of limiting access are to ensure that users have only the access needed to perform their duties; that access to very sensitive resources, such as security software programs, is limited to very few individuals; and that employees are restricted from performing incompatible functions or functions beyond their responsibility. This is reiterated by Federal guidelines. For example, OMB Circular A-130 and supporting National Institute of Standards and Technology (NIST) security publications provide guidance related to the maintenance of technical access controls. In addition, the Department of Commerce IT Security Program and Minimum Implementation Standards contain many requirements for operating Department IT devices in a secure manner.
  
  During fiscal year 2007, we noted that access controls should be improved at all bureaus and at the Department level, primarily in the areas of: (1) managing user accounts, (2) logical controls over financial system and network access, (3) strengthening password controls, (4) improving data center access, (5) configuring settings of system devices, (6) monitoring user actions through the use of audit trails, and (7) consistent application of patch management practices to protect system devices against vulnerabilities associated with malicious threats and attacks. We recognize that the Department and its bureaus have some compensating controls in place to help reduce the risk of the identified vulnerabilities, and we have considered such compensating controls as part of our overall consolidated financial statement audit.
  
• Application software development and change control. The primary focus of application software development and change control is on controlling the changes that are made to software systems in operation. Establishing controls over the modification of application software programs ensures that only authorized programs and authorized modifications are implemented. This is accomplished by instituting policies, procedures, and techniques to determine that all programs and program modifications are properly authorized, tested, and approved, and that access to and distribution of programs is carefully controlled. Without proper controls, there is a risk that security features could be inadvertently or deliberately omitted or turned off, or that processing irregularities or malicious code could be introduced into the IT environment.
  
  During fiscal year 2007, we did not identify any weaknesses related to application software development and change controls at the bureaus within the scope of our audit.
  
• System software. System software is a set of programs designed to operate and control the processing activities of computer equipment. System software helps control the input, processing, output, and data storage associated with all of the applications that run on a system. Controls over access to and modification of system software are essential in providing reasonable assurance that operating system-based security controls are not compromised and that the system will not be impaired.
  
  During fiscal year 2007, we noted that system software controls should be improved at one bureau by improving patch management documentation processes.
  
• Segregation of duties. Work responsibilities should be segregated so that an individual does not control more than one critical function within a process. Inadequately segregated duties increase the risk that erroneous or fraudulent transactions could be processed, improper program changes could be implemented, and computer resources could be damaged or destroyed. Key areas of concern for segregation of duties involves duties among major operating and programming activities, including duties performed by users, application programmers, and data center staff. Policies outlining individual responsibilities should be documented, communicated, and enforced. The prevention and/or detection of unauthorized or erroneous actions by personnel require effective supervision and review by management, as well as formal operating procedures.
  
  During fiscal year 2007, we noted a weakness related to segregation of duties that affected the implementation of system software modifications at one bureau.
  
• Service continuity. Losing the capability to process, retrieve, and protect information maintained electronically can significantly affect an agency’s ability to accomplish its mission. For this reason, an agency should have: (1) procedures in place to protect information resources and minimize the risk of unplanned interruptions, and (2) a plan to recover critical operations should interruptions occur.
  
  During fiscal year 2007, we noted that service continuity controls should be improved at five bureaus and at the Department level, primarily in the areas of: (1) updating contingency plans to include appropriate controls and reflect current processing environments, (2) testing disaster recovery and continuity plans, (3) procuring alternate processing sites, (4) establishing off-site storage locations that are geographically removed from primary processing sites, (5) developing a detailed policy and procedure for backing up key financial systems, and (6) improving data center physical and environmental controls.

Recommendations

Specific recommendations are included in a separate limited distribution IT general controls report, issued as part of the fiscal year 2007 consolidated financial statement audit. The Department should monitor bureau actions to ensure effective implementation of our recommendations.

Management’s Response

Management agreed with our findings, conclusions, and recommendations related to improving the Department’s financial management systems controls. The Department is in the process of developing corrective action plans to address the recommendations presented in the separate limited distribution IT general controls report.