via InformationWeek Government
The federal government’s new regime for cybersecurity compliance, which leans heavily on continuous monitoring of IT system security, was supposed to cut back on the arduous and unnecessary paperwork that has historically been required. But Congressional auditors are now butting heads with the Department of State on just how much documentation should be required.
In an audit of the State Department’s IT security controls, the Government Accountability Office determined that the agency’s custom iPost risk-scoring program doesn’t sufficiently detail vulnerabilities, doesn’t update data completely or frequently enough, and doesn’t have processes in place to adequately validate the data that iPost uses.
GAO also raised additional concerns, such as iPost addresses Windows systems but not other devices like routers and switches and non-Windows systems, that its scoring system fails to reflect the impact and likelihood of threats, and that it should include more risk factors.