AUD-07-014 Audit Report Cover

September 2007 Report No. AUD-07-014 Independent Evaluation of the FDIC’s Information Security Program-2007 AUDIT REPORT Report No. AUD-07-014 September 2007 Independent Evaluation of the FDIC’s Information Security Program-2007 Results of Evaluation Background and Purpose of Evaluation The FDIC has made significant progress in recent years in addressing the information security provisions of FISMA and the National Institute of Standards The FDIC Office of Inspector and Technology. This progress is noteworthy given the considerable increase in General (OIG) contracted with information-security-related requirements levied on federal agencies. KPMG KPMG, LLP (KPMG) to found that the FDIC established policies and procedures in substantially all of the conduct an independent security control areas evaluated. In addition, KPMG noted particular strength in evaluation of the FDIC’s the areas of Information Security Governance, Incident Response, and Awareness information security program and Training and that additional improvements were underway at the close of the and practices pursuant to the evaluation. Federal Information Security Management Act of 2002 These accomplishments are notable. However, as reflected in the table below, (FISMA). FISMA requires KPMG identified a number of information security control deficiencies federal agencies, including the warranting management attention. Addressing these security control ...