# Presentation: 755172

## SSA OIG’s FISMA Approach

- Presented by
- Kitt Winter & Phil Rogofsky
- Office of Audit
- Data Analysis & Technology Audit Division

## SSA’s System Security Program

**Oversees $653 billions in the trust fund and pays out $504 billions in benefits (annual estimates) to over 50 million beneficiaries. **
**Processes over 260 million earning records annually and maintains a database over 400 million earnings records.**
**Issues over 18 million original and replacement Social Security Cards annually.**
**17 sensitive systems processes information from over 1,300 field offices.**

## SSA hired PwC as independent auditor since 1997.
In 2001, SSA awarded PwC 5-year Financial Statement (F/S) audit contract.
Internal control testing includes FISCAM review of the 17 sensitive systems.

- In 2001, SSA awarded PwC 5-year Financial Statement (F/S) audit contract.
- Internal control testing includes FISCAM review of the 17 sensitive systems.

**OA’s efforts to comply with CFO requirements**

## FISMA Requirements

- OIG performs an annual independent evaluation of Agency’s security program .
- Since PwC’s F/S audit includes extensive testing of IS controls, OIG contacted PwC to perform additional steps to evaluate Agency’s compliance with FISMA and issue an opinion.
- Since FISMA does not require an audit, the decision was made to have PwC complete agreed-upon procedures rather than opinion-level work.

## FISMA Agreed-Upon (AUP) procedures

- 	OIG contracted PwC to perform an          Agreed-Upon-procedures engagement using following criteria:
- FISMA
- OMB Memorandum M-03-19
- NIST Guidance
- Other relevant security laws and 			    regulations

## SSA’s  self-assessment of FISMA

- Each system owner completed the NIST Self-Assessment Guide (questionnaire).
- The Agency engaged Deloitte & Touche        (D & T) to conduct an independent assessment on the Agency’s self-assessment of its IT security program using FISMA and NIST questionnaire for IT systems.

## What OA does to meet FISMA requirements

- Review PwC F/S EDP testing and FISMA AUP audit plans.
- Monitor F/S EDP control audit and FISMA AUP procedures.
- Oversee/observe PwC security testing
- Review PwC F/S EDP audit and FISMA AUP workpapers and final reports.

**Notes:**
Review PwC FS audit plan and monitor the audit through holding weekly meetings
Monitor FS audit in respect to EDP controls by holding weekly meetings with PwC
Monitor FISMA Agree-Upon procedures conducted through regular meetings and discussion
Oversee and observe PwC conducting security testing including penetraion testing, firewall review, and wireless testing
Review PwC reports on FISMA engagement 
Review PwC FISMA Agree-Upon procedure workpapers
Review PwC financial statement internal control management letters and reports

## What OA does to meet FISMA requirements

- Review D & T’s evaluation report.
- Review Agency’s FISMA self-assessment.
- Review reports and works conducted by other contractors as well as OA.
- Conduct interviews and research to resolve outstanding issues.
- Draft OIG report.

**Notes:**
Review PwC FS audit workpapers in respect to EDP controls
Review Deloitte & Touche’s evaluation report on Agency’s FISMA self-assessment
Review Agency’s FISMA self-assessment 
Review various audits and evaluations conducted by other contractors, PwC, and OA
Conduct various interviews, research to resolve issues
Work with Office of Financial and Accounting Management and Office of the Chief Financial Officer to discuss and resolve outstanding issues
Draft OIG independent evaluation report and communicate our findings with the Agency

## Exchange draft FISMA reports.
FISMA status meetings held to discuss
Issues (findings)
Current status
What is required to resolve issue
OIG reviews follow-up actions

- FISMA status meetings held to discuss
**Issues (findings)**
**Current status**
**What is required to resolve issue**
- OIG reviews follow-up actions

**SSA/OIG Communication**

## FISMA issues

- What is a system?
- What is deficiency/weakness?
- Evaluation vs. audit
- Last minute OMB policy changes
- Role of CIO
- Report Format

## Continue with current approach
Follow-up with the Agency on prior year findings
Modify according to OMB guidance update

- Follow-up with the Agency on prior year findings
- Modify according to OMB guidance update

**Plans for next year**