Bureau of the Public Debt:

Areas for Improvement in Information Security Controls

GAO-06-522R: Published: Mar 16, 2006. Publicly Released: Mar 16, 2006.

Additional Materials:

Contact:

Gary T. Engel
(202) 512-8815
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

In connection with fulfilling our requirement to audit the financial statements of the U.S. government, we audited and reported on the Schedules of Federal Debt Managed by the Bureau of the Public Debt (BPD) for the fiscal years ended September 30, 2005 and 2004. As part of these audits, we performed a review of the general and application information security controls over key BPD financial systems. This report presents the issues identified during our fiscal year 2005 testing of the general and application information security controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt. This report also includes the results of our follow-up on the status of BPD's corrective actions to address recommendations that were contained in our prior years' audits and open as of September 30, 2004. We also assessed the general and application information security controls over key BPD financial systems that the Federal Reserve Banks (FRB) maintain and operate on behalf of BPD. We will issue a separate report to the Board of Governors of the Federal Reserve System on the results of such testing.

Our fiscal year 2005 audit procedures identified opportunities to strengthen certain information security controls that support key BPD automated financial systems relevant to BPD's Schedule of Federal Debt. Specifically, our audit procedures identified 11 new general information security control issues that relate to access controls and system software. In the Limited Official Use Only report, we made nine recommendations to address these issues. Our follow-up on the status of BPD's corrective actions to address nine open recommendations related to eight general and application information security control issues identified in prior years' audits for which actions were not complete as of September 30, 2004, identified the following: (1) as of September 30, 2005, corrective action on seven of the nine recommendations had been completed; and (2) corrective action was in progress as of September 30, 2005, on the two remaining open recommendations, which relate to access controls and application controls.

Status Legend:

More Info
  • Review Pending-GAO has not yet assessed implementation status.
  • Open-Actions to satisfy the intent of the recommendation have not been taken or are being planned, or actions that partially satisfy the intent of the recommendation have been taken.
  • Closed-implemented-Actions that satisfy the intent of the recommendation have been taken.
  • Closed-not implemented-While the intent of the recommendation has not been satisfied, time or circumstances have rendered the recommendation invalid.
    • Review Pending
    • Open
    • Closed - implemented
    • Closed - not implemented

    Recommendation for Executive Action

    Recommendation: The Commissioner of the Bureau of the Public Debt should direct the appropriate BPD officials to implement the nine new detailed recommendations set forth in the separately issued Limited Official Use Only version of this report.

    Agency Affected: Department of the Treasury: Bureau of the Public Debt

    Status: Closed - Implemented

    Comments: In connection with our audits of the fiscal years 2006, 2007, and 2008 Schedules of Federal Debt, we reviewed the status of actions taken to address the open information security control recommendations at the Department of the Treasury's Bureau of the Public Debt (BPD) data center identified during our prior years' audits. BPD management has implemented all nine recommendations.

    Jul 9, 2014

    Jun 19, 2014

    May 30, 2014

    May 15, 2014

    May 13, 2014

    May 12, 2014

    May 2, 2014

    Mar 27, 2014

    Mar 13, 2014

    Looking for more? Browse all our products here