Released by the Bureau of Resource Management
Information Technology Inspections of Embassy Lisbon, Portugal (IT-I-03-03) and Embassy Madrid, Spain (IT-I-03-04)
The OIG inspected the management, operational and technical IT security controls implemented by Embassy Lisbon and Embassy Madrid. These controls involved IT security policies, procedures, activities, and software and hardware settings. OIG found several opportunities for improving IT security at both Embassies. The missions could significantly improve their:
• management controls by periodically assessing its IT security vulnerabilities and risks, preparing and implementing IT security plans to mitigate the identified vulnerabilities and risks, and routinely review and improve the established IT security controls.
• operational controls by better ensuring the adequacy of IT security experience, training and education for its cleared American IT administrators, and of its annual IT security awareness training for all users.
• technical controls by improving the management of its identification, authentication, configuration, and audit trails controls.
|
