A new report from the Department of Energy’s Office of Inspector General (OIG) reveals that while the Department, including the National Nuclear Security Administration, has acted on some previously identified cybersecurity weaknesses, significant gaps remain. Of 63 recommendations from prior audits and evaluations, the OIG report identified that only 19 were closed, leaving 44 still open. In addition, the OIG issued 79 new recommendations during the fiscal year covering various aspects of DOE’s unclassified cybersecurity program.
“The weaknesses identified occurred for a variety of reasons. For instance, findings at some Department sites had occurred due to vulnerability management processes that were not fully effective in identifying, addressing, and/or remediating vulnerabilities,” according to a report titled ‘The Department of Energy’s Unclassified Cybersecurity Program – 2024,’ which the OIG made public this week. “We also found that several sites had not fully developed and/or maintained policies and procedures to help facilitate the design and implementation of security controls.”
It added that without improvements to address the weaknesses identified in our report, the Department may be unable to adequately protect its information systems and data from compromise, loss, or modification.
The agency recommended 123 actions in fiscal year 2024 that, if fully implemented, would strengthen the Department’s unclassified cybersecurity program. The Department needs to prioritize closing findings promptly, particularly those carried over from prior years. With cybersecurity an ongoing challenge, timely adoption of federal requirements and enhancements is critical to ensure the Department’s data and information systems are protected against emerging threats and vulnerabilities.
“Our FY 2024 evaluation determined that the Department had taken actions to address some of the previously identified weaknesses,” according to the OIG report. “Specifically, Department programs and sites had taken corrective actions related to areas such as risk management, configuration management, information continuous monitoring, and identity and access management. This resulted in the closure of 19 of 63 (30 percent) recommendations made during our prior year audits and evaluations. However, 44 prior year recommendations remained open related to weaknesses in areas such as risk management, configuration management, identity and access management, ISCM, and security training.”
It added “we issued 79 new recommendations throughout FY 2024. The Department was able to close three of those recommendations. As a result, 120 recommendations had yet to be fully addressed at the end of the FY. Notably, three sites requested that the OIG not perform follow-up testing on open prior year findings during FY 2024, as corrective actions had not been fully implemented at any of the three sites. As a result, the findings remained open at these sites.”
“Our FY 2024 FISMA evaluation and other OIG reports, issued throughout the year, identified weaknesses within all five National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1, function areas and each of the related security domains,” the OIG report detailed.
The review determined that additional effort is needed to adequately protect the Department’s data and information systems.
The ‘Identify’ cybersecurity function requires that the Department develop an organizational understanding to manage cybersecurity risks to systems, people, assets, data, and capabilities. It includes the two domains of risk management and SCRM (Supply Chain Risk Management). The Identify cybersecurity function relates to several cybersecurity controls found in the NIST Special Publication (SP) 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations, including those supporting asset management, governance, and risk assessment. During the FY 2024 evaluation, the OIG concluded that the Department had not always fully implemented security controls and associated processes related to risk management.
It added “The risk management security domain focuses on an organization’s progress related to asset management, business environment, governance, risk assessment, and risk management strategy. Notably, the Department had taken action to address some of our previously identified risk management weaknesses, and we were able to close nine recommendations.”
The OIG reported that the SCRM security domain evaluates the extent to which an organization-wide strategy is used to manage the supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services. “Cybersecurity SCRM is a systematic process for managing exposure to cybersecurity risk throughout supply chains and developing appropriate response strategies, policies, processes, and procedures. In FY 2024, we evaluated the Department’s progress in developing and implementing related supply chain requirements through our FISMA metric work and identified weaknesses within this area,” it added.
The ‘Protect’ cybersecurity function requires the Department to develop and implement appropriate safeguards to ensure delivery of critical services. It includes four security domains that relate to cybersecurity controls found in NIST SP 800-53, Revision 5—configuration management, identity and access management, data protection and privacy, and security training security domains. “Our FY 2024 evaluation identified weaknesses related to the Department’s implementation of all the security domains included in the Protect cybersecurity function.”
It added that “However, to the Department’s credit, actions were taken to address some of the weaknesses within this function area. As a result, we were able to close five prior year recommendations related to configuration management. In addition, we were also able to close five recommendations related to identity and access management.”
The OIG report highlighted that the configuration management security domain focuses on an organization’s progress related to areas such as utilization of system baselines and secure configurations, vulnerability management, and system change controls. Although the Department took actions to address some known configuration management weaknesses, we continued to identify control deficiencies related to this security domain.
“The identity and access management security domain ensures that organizations implement procedures related to identity, credential, and access management such as the use of personal identity verification credentials; effective management of privileged and non-privileged accounts; and remote access controls,” the report detailed. “The Department had taken actions to close four of the eight recommendations that remained open at the end of FY 2023 and one recommendation that was issued in FY 2024 related to identity and access management. However, our test work continued to identify numerous identity and access management concerns that resulted in the issuance of 21 recommendations.”
The ‘Detect’ cybersecurity function requires that the Department develop and implement appropriate activities to identify the occurrence of a cybersecurity event. “The Detect cybersecurity function relates to several security assessment and authorization cybersecurity controls in NIST SP 800-53, Revision 5, including categories related to ISCM, anomalies and events, and detection processes. During FY 2024, we identified various weaknesses related to the implementation of the Detect cybersecurity function.”
The ‘Respond’ cybersecurity function requires the Department to develop and implement appropriate activities to act against a detected cybersecurity incident and includes the incident response security domain. The Respond cybersecurity function relates to the incident response cybersecurity controls found in NIST SP 800-53, Revision 5, including categories relevant to response planning, communications, analysis, mitigation, and improvements. “Throughout our test work, we identified weaknesses related to these cybersecurity control activities.”
The ‘Recover’ cybersecurity function requires the Department to develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. “The Recover cybersecurity function includes one information security domain—contingency planning. The Recover function relates to the contingency planning cybersecurity controls found in NIST SP 800-53, Revision 5, including categories related to recovery planning, improvements, and communication. During FY 2024, we identified deficiencies within the implementation of this cybersecurity function.”
Listing its recommendations, the DoE OIG report identified that “To address the identified cybersecurity program weaknesses throughout the Department, we made 79 new recommendations2F 3 in FY 2024. In addition, 44 prior year recommendations remained open. Specific recommendations were made to the Department’s programs and sites where weaknesses were identified, including those identified during this evaluation and in other reports issued.”
“During FY 2024, the Department took corrective actions and was able to close 3 newly issued recommendations; therefore, at the end of FY 2024, 120 cybersecurity recommendations remained open and required the attention of Department officials,” it added. “Corrective actions to address each of the recommendations, if fully implemented, should enhance the Department’s unclassified cybersecurity program. Although management at the sites and programs reviewed concurred with most of our findings, management at two sites did not concur with four of our recommendations. However, our testing results supported their issuance, and therefore, all issued findings and recommendations will remain open until the described weaknesses have been addressed.”
The management concurred with 75 of 79 new recommendations issued in FY 2024 to the programs and sites related to improving the Department’s cybersecurity program, according to the OIG report. “However, management nonconcurred with four recommendations and noted that two of the four were recently closed. Management indicated that it would continue to address the weaknesses at all organizational levels to adequately protect the Department’s information assets and systems from harm. Management also commented that a number of actions had been taken to address the 63 cybersecurity program weaknesses previously noted by the OIG, closing out 19.”
The OIG response was that the “management’s comments and planned corrective actions were responsive to recommendations made during our evaluation. Due to the timing of our test work, we did not validate any noted corrective actions. In addition, and in relation to the four recommendations that management nonconcurred with, we continue to note that our testing results in FY 2024 supported all recommendations issued. Further, we modified certain language in the report to ensure that it was not Controlled Unclassified Information.”
