TSP Gets Lowest Possible Score on Information Security Audit

[James48843]

From today’s
GovExec.com

The agency that administers the federal government’s 401(k)-style retirement program received the lowest of five possible scores on a recent audit to determine its compliance with federal information security standards.

Auditors with the consulting firm Williams Adley examined the information security program of the Federal Retirement Thrift Investment Board, which administers the Thrift Savings Plan, under the Federal Information Security Modernization Act. In the first annual study of FRTIB’s policies, the agency scored a Level 1 in accordance with the law’s fiscal 2017 inspector general reporting metrics, out of a possible five.

Although FRTIB had started a number of initiatives to upgrade its IT infrastructure and cybersecurity in recent years, auditors found those policies to remain primarily “ad hoc” in nature. An effective information security program is scored at Level 4, which includes collection of “quantitative and qualitative measures on the effectiveness of policies, procedures and strategy” at an agency and assessment for what changes are necessary.



More:

TSP Gets Lowest Possible Score on Information Security Audit - Oversight - GovExec.com


Sent from my iPhone using TSP Talk Forums

 

[nasa1974]

So what are they spending the multimillion dollars on every year? That also increases every year. I haven't read the monthly meeting minutes in awhile but the increases always seemed to be for computer/server/software upgrades.

 

[kave]

Thank you for posting this James!

 

[nasa1974]

So the article states that "An effective information security program is scored at Level4". The FRTIB was scored at a Level 1.

"Suzanne Tosini, chief operating officer and acting chieftechnology officer for the TSP, said the agency is moving forward with plans toimplement Williams Adley’s recommendations, and it will strengthen itscontractor oversight policies. She provided a roadmap that projects the agencywill reach a Level 3 score—“Consistently Implemented”—in fiscal 2019, whichwould be reflected in the fiscal 2020 audit."

Why are they not trying to get to a Level 4 score instead of "moving forward with plans" and "projects the agency will reach a Level 3 score in fiscal 2019" and the 2020 audit?

 

[RealMoneyIssues]

So the article states that "An effective information security program is scored at Level4". The FRTIB was scored at a Level 1.

"Suzanne Tosini, chief operating officer and acting chieftechnology officer for the TSP, said the agency is moving forward with plans toimplement Williams Adley’s recommendations, and it will strengthen itscontractor oversight policies. She provided a roadmap that projects the agencywill reach a Level 3 score—“Consistently Implemented”—in fiscal 2019, whichwould be reflected in the fiscal 2020 audit."

Why are they not trying to get to a Level 4 score instead of "moving forward with plans" and "projects the agency will reach a Level 3 score in fiscal 2019" and the 2020 audit?

Moving at the speed of government...

Sent from my SM-J727V using Tapatalk

 

[PessOptimist]

What's the big deal? The agency handling your background check or security investigation has been hacked, OPM, DOD and likely most federal agencies have been hacked. Your info is out there. The question is can someone start sucking your funds out of your TSP? Relax. They may give you 1 year free credit monitoring. Rest assured a business plan is being formulated to address the problem.

PO

 

[bmneveu]

Any plan that aims for anything less than level 5 is a failure of leadership. Couple that with the audit revealing a current level 1 and I don't know how these people still have their jobs.

 

[tom4jean]

What's the big deal? The agency handling your background check or security investigation has been hacked, OPM, DOD and likely most federal agencies have been hacked. Your info is out there. The question is can someone start sucking your funds out of your TSP? Relax. They may give you 1 year free credit monitoring. Rest assured a business plan is being formulated to address the problem.

PO

You got that right, I have had three breeches of my information from working for the government, one from when I was in the army and two from the VA. I have credit monitoring for free but don't feel too good about it.