INFORMATION TECHNOLOGY: 

Management’s Planned Actions For 

Establishing and Enforcing Web 

Site Practices and Policies Have 

Not Been Fully Implemented

 OIG-02-029 December 31, 2001 

Office of Inspector General

*******

The Department of the Treasury
Contents 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 1 

Audit Report................................................................................................. 3 

 Results in Brief............................................................................................ 5 

 Background................................................................................................. 7 

 Findings and Recommendations..................................................................... 8 

 Persistent Cookies Are Established Without Approval or Warning Banners...... 9 

 Recommendations................................................................................... 11 

 Treasury Needs to Formalize and Enforce Web Policies .............................. 13 

 Recommendations .................................................................................. 15 

Appendices

 Appendix 1: Objective, Scope, and Methodology ....................................... 17 

 Appendix 2 Persistent Cookies Found During Original Audit ....................... 18 

 Appendix 3: Additional Persistent Cookie Sites Found ................................ 19 

 Appendix 4: Privacy Statements .............................................................. 20 

 Appendix 5: Exit Banners........................................................................ 21 

 Appendix 6: Comparison Of Treasury’s Current Web Site Inventory To 

 Original Audit Sites .............................................................. 22 

 Appendix 7: Management Comments ....................................................... 24 

 Appendix 8: Major Contributors To This Report ......................................... 27 

 Appendix 9: Report Distribution............................................................... 28 

Abbreviations 

 BPD Bureau of the Public Debt 

BEP Bureau of Engraving and Printing 

CCCAC Citizens Commemorative Coin Advisory Committee 

CIO Chief Information Officer 

Customs United States Customs Service 

DO Departmental Offices 

FLETC Federal Law Enforcement Training Center 

FMS Financial Management Service 

ITIPS Information Technology Investment Portfolio System 

Mint U.S. Mint 
Contents 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 2 

OIG Office of Inspector General 

OCC The Office of Comptroller of the Currency 

OTS The Office of Thrift Supervision 

OMB Office of Management and Budget 

Secretary Secretary of the Treasury 

Treasury Department of the Treasury 

USSS United States Secret Service 
OIG Audit 

Report

The Department of the Treasury 

Office of Inspector General 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 3 

January 7, 2002 

James J. Flyzik 

Deputy Assistant Secretary for Information Systems and Chief 

Information Officer 

Department of the Treasury 

The Office of Inspector General (OIG), in response to the 

Consolidated Appropriations Act of 2001 (P.L. 106-554), prepared 

a report addressing the Department of the Treasury’s (Treasury) 

use of persistent cookies on its web sites. The report, “Treasury 

Web Sites Substantially Comply With OMB Policies And Data 

Collection Standards” (OIG-01-044), was issued on 

February 17, 2001. In the audit, the OIG found that select 

Treasury bureaus set persistent cookies and the administration of 

Treasury web sites needed improvement. We are once again 

making recommendations to assist Treasury in correcting 

deficiencies and ensure the proper use of cookies. 

The overall objective of this follow-up audit was to determine 

whether management’s previous commitment for planned actions, 

to address prior OIG recommendations, were implemented. We 

also determined whether bureaus with cookies were seeking or had 

obtained Secretarial approval. Pending approval, the bureaus were 

to post conspicuous warnings on their sites stating that persistent 

cookies were in use and that approval was being sought. In 

addition, the Office of the Chief Information Officer (CIO) was to 

formalize and enforce web policies that include site exit banners 

and privacy statements. The plans also required that the CIO’s 

office maintain an inventory of Treasury web sites. The OIG found 

that while the Secretary had approved the use of cookies for three 

Treasury web sites (www.itips.gov, www.usmint.gov, and 
Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 4 

www.nationalbanknet.gov1

), the findings identified in OIG-01-044 

continue to exist. Treasury and its bureaus continued to use 

persistent cookies without posting warning banners and the CIO’s 

office still needs to formalize and enforce web policies. 

Our initial fieldwork was completed between May and July 2001. 

Some additional follow-up fieldwork was completed in 

September 2001. We conducted meetings with members of the 

CIO’s office, reviewed documentation, and conducted extensive 

web site research. The web research included the original Treasury 

audit sites in addition to sites discovered during our review 

process. A more detailed description of our objective, scope, and 

methodology is provided in Appendix 1. 

The Treasury CIO’s responses to our draft report concurred with 

our findings and recommendations. The responses are evaluated 

and summarized in the body of this report and included in detail as 

Appendix 7.

 

1

 Both www.nationalbanknet.gov and www.banknet.gov, two site addresses included in our audit, appear to go to the 

same web site. For the purpose of this audit, we are considering this as one web site address. 
Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 5 

Results in Brief 

During our review, we found that the audit issues previously 

identified in OIG-01-044 were not fully resolved. The Treasury and 

its bureaus continued to use persistent cookies on their web sites 

without the placement of a conspicuous warning identifying that 

cookies were in use. In addition, we identified that Treasury’s web 

site administration continues to need improvement. 

The CIO’s office, as part of its plans to address issues identified in 

OIG-01-044, drafted a Treasury Directive entitled “Certification 

Process for the Use of Persistent Cookies on Treasury Web Sites.” 

The CIO’s office also issued memorandums addressing the 

Treasury’s policy concerning persistent cookies and the submission 

of requests for approval for the bureaus’ use of persistent cookies. 

In addition, the CIO’s office created a Treasury-wide web site 

inventory and requested that bureau CIOs add or delete sites, as 

necessary, to ensure the accuracy of the inventory. 

In addition to the above, the CIO’s office also agreed that 

prominent warning banners would be placed on its web pages 

when Treasury and its bureaus used persistent cookies. 

Furthermore, the use of persistent cookies was to be authorized by 

the Secretary, or his delegate. The cookie approval process, in 

part, required a justification to use persistent cookies. 

During our audit, we identified that the Secretary had approved the 

use of persistent cookies for three Treasury web sites—one 

Departmental Office (DO) web site, the U.S. Mint (Mint) site, and 

one for the Office of Comptroller of the Currency (OCC). However, 

we also determined that other Treasury bureaus using persistent 

cookies had not yet obtained the proper approval for their use. 

Additionally, only one of the sites included in our audit had the 

required conspicuous warning banner notifying the users that 

cookies were in use. In one instance, the OIG discovered a 

Treasury web site where, after a user subscribed to a monthly 

e-mail newsletter, a persistent cookie was set on the user’s 

computer each time the monthly newsletter was opened. The OIG 

discussed this issue with the site management who took immediate 

action to mitigate this problem. 
Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 6 

We also found that Treasury web site administration continues to 

need improvement. Though the OIG previously recommended that 

the CIO’s office establish and enforce consistent web policies, 

including the use of site exit banners and privacy statements, we 

identified several sites that did not present exit banners and one 

site that operated without a privacy statement. 

In OIG-01-044, the OIG also recommended that a full inventory of 

Treasury web sites be maintained and that the CIO’s office be 

notified prior to the establishment of any new web sites. While the 

CIO’s office developed a Treasury web site inventory, our review 

showed that they had not created a policy for notifying the CIO’s 

office prior to the establishment of any new web sites, and that 

Treasury’s inventory was both inaccurate and incomplete. 

To assure that the issues above are addressed, we are again 

recommending that the CIO’s office ensure that warning banners 

are displayed where persistent cookies exist. A notice explaining 

that a site is awaiting the approval for the use of cookies should 

also be displayed, when such a notification has been submitted and 

not yet approved. Additionally, the CIO needs to formalize and 

enforce web policies by issuing the Treasury Directive 

“Certification Process for the Use of Persistent Cookies on 

Treasury Web Sites,” and by maintaining a current inventory of 

Treasury web sites. We believe these recommendations will assist 

the CIO to exert authority over all web activities in the Treasury 

and require adherence to a set of established policies. 

The Treasury CIO’s responses to our draft report concurred with 

our findings and recommendations. The responses were evaluated 

and summarized in the body of this report and included in detail as 

Appendix 7. 
Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 7 

Background

In management’s response to our original audit, which addressed 

the use of persistent cookies1 at web sites (“Treasury Web Sites 

Substantially Comply With OMB Policies And Data Collection 

Standards” (OIG-01-044), issued February 17, 2001), the CIO’s 

office was to work with all parties to obtain the requisite approval 

for the use of cookies from the Secretary, or his designee, within 

60 days. The bureaus, while seeking approval, were to post 

conspicuous warnings on their web sites to advise users that 

persistent cookies were used and approval for their use was being 

sought. Within 90 days, the CIO’s office was to formalize and 

enforce web policies that included site exit banners and privacy 

statements. The CIO’s office was to update and maintain a 

Treasury web site inventory within 30 days. 

In performing our follow up audit of the Treasury management’s 

efforts to address the recommendations in our original report, we 

met with members of the CIO’s office, reviewed documentation, 

and did extensive web site research. The purpose of the research 

was to determine whether the original audited Treasury and bureau 

web sites, and other Treasury sites discovered during our research, 

were updated to reflect the Treasury’s proposed corrective actions. 

 

1

 “A cookie is a short string of text—not a program—that is sent from a web server to a web browser when the browser 

accesses a web page. The use of cookies allows the server to recognize returning users, track on-line purchases, or 

maintain and serve customized web pages. Domain cookies are cookies placed by the visited web site. However, some 

web sites also allow the placement of third-party cookies—cookies placed on a visitor’s computer by a domain other 

than the site being visited. The domain and third-party cookies may be further grouped into session and persistent 

cookies. Session cookies are short-lived, are used only during the browsing session, and expire when the user quits the 

browser. Persistent cookies specify expiration dates, remain stored on the client’s computer until the expiration date, and 

can be used to track users’ browsing behavior by identifying their Internet addresses whenever they return to a site.” 

U. S. General Accounting Office: Federal Agency Use of Cookies (GAO-01-147R) 
Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 8 

Findings and Recommendations 

 

During the audit, the OIG determined that the Secretary had 

approved the use of persistent cookies for three Treasury web 

sites. However, we also found that two other Treasury web sites 

had persistent cookies placed on user’s hard drives without 

approval. Additionally, only one of the sites included in the audit 

had the required conspicuous warning banner notifying the users 

that cookies were in use. 

Five Treasury sites lacked exit banners, one site lacked a privacy 

statement, and seven active web sites were not included in 

Treasury’s web site inventory. We also found that the CIO’s office 

needs to complete the formalization and enforcement of web site 

policies. The CIO’s office drafted a Treasury Directive, 

“Certification Process for the Use of Persistent Cookies on 

Treasury Web Sites,“ that addressed cookies and identifies the 

requirement for exit banners and privacy statements. Pending the 

issuance of the directive, the CIO’s office provided guidance 

memorandums. In addition, the CIO’s office took steps to address 

the inaccuracy of their web site inventory. 

As identified in the original audit, the lack of a warning banner for 

persistent cookies is in contradiction to the Office of Management 

and Budget’s (OMB) Privacy Policies and Data Collection on Federal 

Web Sites.2

 Additionally, the absence of formalized web policies 

and an inaccurate web site inventory places the Treasury at risk of 

having “rogue” sites that do not meet established management and 

oversight controls. 

 

2

 OMB Memorandum, Privacy Policies and Data Collection on Federal Web Sites (M-00-13), dated June 22, 2000, 

specifically states that under Federal policy, "cookies" should not be used at Federal web sites or by contractors when 

operating web sites on behalf of agencies, unless: (1) a clear and conspicuous notice is displayed; (2) there is a 

compelling need to gather the data on the site; (3) there are appropriate and publicly disclosed privacy safeguards for the 

handling of information derived from "cookies"; and (4) the personal approval by the head of the agency has been 

obtained. 
Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 9 

Finding 1 Persistent Cookies Are Established Without Approval or 

Warning Banners 

In response to our original audit, the CIO’s office believed that the 

bureaus using persistent cookies had valid and compelling business 

reasons to do so. To address this issue, the CIO’s office indicated 

that it would work with all parties to obtain the requisite approvals 

from the Secretary or his designee. Pending this approval, the 

bureaus were to post conspicuous warnings on their web sites 

explaining that persistent cookies were being used and that 

approval was being sought. 

Treasury web sites, however, are still not fully compliant with the 

OMB’s Privacy Policies and Data Collection Standards. The 

Treasury CIO cannot assure the OMB, or the public at large, that 

the continued use of persistent cookies on the remaining sites is 

justified or warranted. 

Need for Treasury Persistent Cookies Approval Process 

The CIO’s office needs to finalize its process for the approval, or 

disapproval, of persistent cookies. We found that there was no 

specific guidance for Treasury and its bureaus for using persistent 

cookies. Rather, it was the position of the CIO’s office that they 

would review and evaluate bureaus’ submissions justifying the use 

of persistent cookies. 

We identified five Treasury web sites that set persistent cookies. 

Four of the web sites were previously identified in our original 

audit. One web site was discovered during our follow-up review of 

Treasury’s web site inventory. Of the five web sites included in 

this review, the Secretary approved the use of cookies for three of 

Treasury’s web sites—a DO web site (www.itips.gov), the Mint 

site (www.usmint.gov), and a site hosted by the OCC 

(www.nationalbanknet.gov)--on September 4, 2001. The other 

two sites did not seek and did not have approval to set persistent 

cookies–one hosted by the Mint (cccaconline.org) and the other 

hosted by the Bureau of Engraving and Printing (BEP) 

(www.bep.treasury.gov/kids/index.cfm). (See Appendix 2, 

“Persistent Cookies Found At Original Audit Sites,” and Appendix 

3, “Additional Persistent Cookie Sites Found,” for further details.) 
Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 10 

Persistent Cookies Set Without Warning Banners 

In addition to the above, the OIG found that only one of the five 

Treasury web sites using persistent cookies, the Information 

Technology Investment Portfolio System (ITPS) site 

(www.itips.gov), displays a conspicuous banner warning users that 

persistent cookies are being used. The other four Treasury sites 

continued to do so without posting warning banners. 

Though there is no warning banner, the OIG discovered that the 

Mint site (www.usmint.gov) does include a notice regarding the 

use of cookies within its privacy statement, as does the Mint 

hosted Citizens Commemorative Coin Advisory Committee’s 

(CCCAC) web site (cccaconline.org). The Mint’s privacy statement 

also includes the following assertion: “We don’t use cookies to 

store individually-identifiable information, or track your actions over 

time or across Web sites.“ The CCCAC’s privacy statement also 

makes an assertion similar to the Mint’s regarding the use of 

cookies to store individually identifiable information. OIG also 

discovered that users were provided the opportunity to join the 

Mint Coins Online Newsletter. After subscribing to the newsletter, 

a cookie was set on the user’s hard drive when the newsletter was 

opened. The OIG discussed this issue with management during the 

audit, and the Mint took immediate action to mitigate this problem. 
Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 11 

Recommendations

To ensure the proper use of cookies, the Treasury CIO should 

immediately: 

1. Remove unapproved persistent cookies from the Treasury’s web 

pages or shutdown affected web sites. While reprogramming 

the web sites to remove persistent cookies, the web sites still in 

operation should place a warning banner on the home page 

specifically alerting all users of the current existence of 

persistent cookies and their planned removal. 

2. Require that Treasury components intending to use persistent 

cookies justify their compelling need for these cookies on their 

web sites. 

3. Identify all web sites that continue to set persistent cookies, 

and require the submission of bureau requests for the approval 

to use persistent cookies at these sites. 

4. Ensure that web sites hosted by Treasury or its bureaus 

conform to Treasury’s requirements. 

Management Response 

The CIO Office contacted the bureaus that had been identified as 

having “persistent cookies.” Action was taken by the two 

organizations in question and “persistent cookies” are no longer 

used on the websites. 

Treasury’s Internet/Intranet Program Manager contacted each 

bureau and office website administrator instructing them to begin 

immediate use of exit banners for all public websites and all other 

domain links as well, if such notifications were not already in place. 

The requirement to use exit banners are to be included in the 

Treasury Directive TD 81-80, along with completion dates for 

these actions. Bureaus and offices are to complete the 

implementation of exit banners for public websites by January 31, 

2002. At that time, Treasury’s Internet/Intranet Program Manager 

will canvas the bureaus and offices to ensure the action is 

complete. 
Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 12 

Furthermore, the directive will instruct each bureau and office to 

implement the use of exit banners to all other domain links 

including publicly accessible government websites no later than 

March 31, 2002. 

In addition, the directive will include a requirement to update the 

website inventory. The action is to be completed by January 15, 

2002, and the update of the inventory is be done annually 

thereafter and forwarded to the Department’s Internet/Intranet 

Program Manager. 

 OIG Comment: 

We concur with management’s planned actions and consider the 

issue resolved pending completion of the stated remedies. 
Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 13 

Finding 2 Treasury Needs to Formalize and Enforce Web Policies 

In their response to our previous audit, dated February 16, 2001, 

Treasury estimated that it would formalize and enforce web 

policies, including the use of privacy statements and site exit 

banners, within 90 days. In addition, Treasury was to update and 

maintain a web site inventory. The CIO’s office prepared a draft 

Treasury Directive that addresses these issues and, in response to 

the OIG request, created a Treasury web site inventory. Pending 

the approval of the Treasury Directive, the CIO’s office provided 

guidance in memorandum form. Without the formalization of the 

Treasury policies, the associated enforcement and oversight 

functions, and a current web site inventory, the CIO cannot ensure 

that Treasury and its bureaus comply with the standards set by the 

OMB. 

Privacy statements should be placed at the entrance to appropriate 

web sites to assure the public that their privacy concerns are 

addressed. To do this, privacy statements should identify what 

user information is being collected and how this information is 

being protected. During the audit, the OIG researched privacy 

statements by re-visiting the original audit sites that did not have 

privacy statements. Based upon our review, we identified that 

only one site still did not have a privacy statement. 

While reviewing the Treasury web sites, we also found that the 

placement of privacy policy statements, or links to the statements, 

varied. For instance, privacy statements and/or links to statements 

were found at the top, bottom, center, and side columns of the 

web pages. Some privacy statements were conspicuously 

presented on the initial screen, while others were “off screen” and 

could only be found by scrolling down the page. (See Appendix 4, 

“Privacy Statements,” for details.) 

The placement of exit banners, prior to or at the point the public 

exits a Treasury web site via a link within the site, advises visitors 

that they are exiting a U. S. Government site and will no longer 

function under or have the assurances made in the Treasury’s 

privacy statement. The OIG, in order to determine the status of 

exit banner use at Treasury sites, re-visited the original audit web 

sites. We found that two sites, Customs and OCC, presented an 
Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 14 

exit banner; however five other sites lacked exit banners. (See 

Appendix 5, “Exit Banners,” for details.) 

In their management response to our original audit, the CIO’s office 

stated that they would maintain a full inventory of Treasury’s web 

sites. However, the OIG found that a formal web inventory had 

not been created. At our request, the CIO’s office created an 

inventory for our review. In order to assess the completeness of 

the inventory provided, the OIG compared the inventory to the list 

of web sites from our prior audit, and also attempted to 

independently identify additional web sites. We determined that 

the inventory did not contain sites still in use from the prior audit. 

Further, we identified the BPD site(www.easysaver.gov) that did 

not appear on the inventory provided by the CIO’s office. As a 

result, Treasury’s inventory remains inaccurate and incomplete. 

(See Appendix 6, “Comparison of Treasury’s Current Web Site 

Inventory to Original Audit Sites,” for further details.) 

Without a current and complete web site inventory, Treasury 

cannot ensure that its web policies and procedures are in place and 

effective. The CIO’s office needs to ensure that “rogue sites” do 

not exist, and that sites that do appear on the inventory adhere to 

Treasury’s policies and procedures. Treasury and bureau web sites 

are assets that are open to the public. The web sites need to be 

managed, controlled, accounted for, and monitored to reduce the 

inherent risks associated with information that is available to the 

public.
Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 15 

Recommendations

The Treasury CIO should: 

5. Ensure web policies are developed, formalized, and enforced. 

Policies should provide for site exit banners, privacy statements, 

web site approval, and administration.

6. Require that all privacy statements, or links to privacy 

statements, be conspicuously placed on the Treasury and 

bureau web sites. 

7. Ensure that all Treasury and bureau web sites linked to external 

sites have appropriate exit banners. 

8. Create an inventory containing all Treasury web sites, establish 

policies and procedures to ensure the inventory is current and 

valid, and require notification prior to the addition and deletion 

of web sites from the inventory. 

Management Response: 

The Office of IT Policy and Strategy forwarded a draft directive (TD 

81-80) for review and comment process. The new directive will be 

issued on or about December 31, 2001. The directive will contain 

guidance that addresses all the issues and policy concerns raised in 

this report as well OIG Audit Report 01-044. 

OIG Comment: 

We concur with management’s planned actions and consider the 

issue resolved pending completion of the stated remedies. 
Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 16 

* * * * * * 

We would like to extend our appreciation to the Treasury CIO’s 

office for the cooperation and courtesies extended to our staff 

during our review. If you have any questions, please contact me at 

(202) 927-5771, or a member of your staff may contact Ed 

Coleman, Deputy Director, Information Technology Audits, at 

(202) 927-5171. Major contributors to this report are listed in 

Appendix 8. 

/S/ 

Clifford H. Jennings 

Director, Information Technology Audits 
Appendix 1 

Objective, Scope, and Methodology 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 17 

The overall objective of this review was to determine whether 

Treasury offices and bureaus have implemented the 

recommendations identified in the original audit. The planned 

actions identified in the management responses were to ensure 

Treasury offices and bureaus are complying with OMB standards 

regarding the collection of personally identifiable information. 

For purposes of this follow-up review, we met with members of 

the CIO’s office, reviewed documentation, and performed extensive 

web site research. We reviewed home pages and web sites for the 

following Treasury offices and bureaus: the Bureau of Alcohol, 

Tobacco, and Firearms, the Bureau of Engraving and Printing, the 

Bureau of Public Debt, the United States Customs Service, 

Financial Management Service, the United States Mint, the Office 

of Comptroller of the Currency, the Office of Thrift Supervision, 

and the United States Secret Service. In addition, we randomly 

linked from the Treasury web site to bureaus and supporting links, 

and used multiple search engines, with “Treasury” as the search, 

to validate the Treasury web site inventory. 

In our review of the documents provided and our extensive web 

site research, we attempted to determine whether the CIO’s office 

had taken the corrective actions outlined in their response to 

OIG-01-044. The planned actions included: 

• The CIO working with all parties to obtain the requisite 

approvals for the use of cookies from the Secretary or his 

designee. 

• Bureaus posting conspicuous warnings on their web sites 

that persistent cookies were being used and that approval 

was being sought for their use. 

• The CIO’s office formalizing and enforcing web policies that 

included site exit banners and privacy statements. 

• Updating and maintaining a Treasury web site inventory. 

The report details initial fieldwork completed in July 2001 and 

some additional follow-up fieldwork completed in September 2001. 

We conducted our review in accordance with generally accepted 

government auditing standards. 
Appendix 2 

Persistent Cookies Found During Original Audit 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 18 

*These sites contain statements asserting that cookies are not used to store individually identifiable 

information. 

 

1

 Both www.banknet.gov and www.nationalbanknet.gov , two site addresses included in our audit, appear to go to the 

same web site. For the purposes of this audit, we are considering this one web site address. 

ORIGINAL AUDIT FINDINGS REVIEW FINDINGS 

 Persistent Treasury Warning 

 Web Secretary’s Persistent Persistent 

 Page Approval to Cookies Cookies 

Bureau/Office Web Page Cookie Use Cookies in Use Are in Use 

DO www.itips.gov Yes Yes Yes Yes 

BEP www.treas.gov/store/index Yes N/A No N/A 

Customs www.itds.treas.gov Yes N/A No N/A 

Mint www.usmint.gov Yes Yes Yes No* 

Mint cccaconline.org Yes No Yes No* 

OCC www.banknet.gov1 Yes Yes Yes No 
Appendix 3 

Additional Persistent Cookie Sites Found 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 19 

SITES FOUND FINDINGS 

 Treasury Warning 

 Secretary’s Persistent Persistent 

 Approval to Cookies Cookies 

Bureau/Office Web Page Use Cookies In Use Are in Use 

BEP www.bep.treas.gov/kids/index.cfm No Yes No 

OCC www.nationalbanknet.gov1 Yes Yes No 

 

1

 Both www.nationalbanknet.gov and www.banknet.gov, two site addresses included in our audit, appear to go to the 

same web site. For the purposes of this audit, we are considering this one web site address. 
Appendix 4 

Privacy Statements 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 20 

Original Audit Sites 

Without 

Privacy Statements 

Bureau/Office - Home Web 

Page 

Placement of 

Statement Site Linked To 

DO 

1 www.fba.gov Bottom of page http://www.treas.gov/privacy.html 

DO 

2 www.fcn.gov Center of page http://www.treas.gov/privacy.html 

DO 

3 www.fedsource.gov Bottom of page http://www.treas.gov/privacy.html 

DO 

4 osdbu.treas.gov None 

ATF NOTE: Firewall Error, Service Unavailable to link 

5 ows.atf.treas.gov:8877 N/A (See NOTE) See www.atf.treas.gov (5-6) 

ATF NOTE: Firewall Error, Service Unavailable to link 

6 ows.atf.treas.gov:9999 N/A (See NOTE) See www.atf.treas.gov (5-6) 

ATF 

(5-6) www.atf.treas.gov Top of page 

BEP 

7 bep.treas.gov/store/index Bottom of page http://www.bep.treas.gov/privacy.htm 

Customs 

8 www.cebb.customs.treas.go

v Bottom of page http://www.customs.treas.gov/top/disclaim.htm 

FMS 

9 www.emoney.gov Bottom of page http://www.emoney.gov/privacy.html 

FMS 

10 www.pay.gov On side column http://63.117.37.125/Privacy.htm 

FMS 

11 secure.treas.gov Not reviewed, not a site 

USSS 

NOTE: Firewall Error, Service Unavailable. Also 

DNS Error 

12 badcheck.treas.gov Linked to USSS, see following (12) 

USSS 

(12)* http://www.ustreas.gov/usss Bottom of page http://www.ustreas.gov/usss/privacy/html 
Appendix 5 

Exit Banners 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 21 

 Linked 

 Bureau/ Site Exit 

Office Home Web Sites (Non-Government) Banner 

1 DO www.ustreas.gov http://fbaseattle.com No 

2 ATF www.atf.treas.gov None N/A 

3 BEP bep.treas.gov http://www.money.org No 

4 BPD www.publicdebt.treas.gov http://www.library.wwii-posters No 

5 Customs www.customs.treas.gov Banner in place Yes 

6 FLETC www.fletc.gov None N/A 

7 FMS www.fms.treas.gov None N/A 

8 Mint www.usmint.gov None N/A 

9 OCC www.occ.treas.gov Banner in place Yes 

10 OTS www.ots.treas.gov http://www.go.com No 

11 USSS www.treas.gov/usss http://www.amw.com No 

Of the eleven sites researched, we identified that two sites had exit banners, and five sites did not have 

exit banners. The four N/A sites did not have non-government links; therefore, no exit banner was 

required. 
Appendix 6 

Comparison of Treasury’s Current Web Site Inventory to Original Audit Sites 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 22 

Original Audit Sites 

Treasury’s Current Inventory of Public Web Sites No Yes 

Active Sites Missing From 

Current Inventory Count

Bureau of Alcohol, Tobacco and Firearms

1 www.atf.treas.gov Yes 

2 ows.atf.treas.gov, (8877/9999) Yes 

Community Development Financial Institution Fund

3 www.treas.gov/cdfi No 

Office of the Comptroller of the Currency

4 www.occ.treas.gov Yes 

5 nationalbanknet.gov No 

 www.banknet.gov 1 

U.S. Customs Service

6 www.treas.gov/auctions/customs No 

7 www.itds.treas.gov Yes 

8 www.cebb.customs.treas.gov Yes 

9 www.customs.treas.gov Yes 

10 www.seaportcommission.gov No 

11 www.nafta-customs.org No 

Departmental Offices

12 www.treas.gov (same as ustreas.gov) Yes 

13 www.itips.treas.gov Yes 

14 www.gits-sec.treas.gov Yes 

15 osdbu.treas.gov Yes 

16 fcn.gov Yes 

17 fba.gov Yes 

18 fedsource.gov Yes 

Bureau of Engraving and Printing

19 

www.bep.treas.gov 

(www.moneyfactory.gov/com) 

[These sites are the same. Yes 

 bep.treas.gov/store/index 2 

Federal Law Enforcement Training Center 

20 www.fletc.gov Yes 

Financial Crimes Enforcement Network 

21 www.treas.gov/fincen No 
Appendix 6 

Comparison of Treasury’s Current Web Site Inventory to Original Audit Sites 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 23 

Original Audit Sites (Cont.) 

Treasury’s Current Inventory of Public Web Sites (Cont.) No Yes 

Active Sites Missing From 

Current Inventory Count 

Financial Management Service 

22 www.fms.treas.gov Yes 

23 

fms2.treas.gov (extranet with /PAID, TROR 

and CMIA) No 

24 paygov.gov Yes 

25 emoney.gov Yes 

26 

apps.fms.treas.gov (extranet for 

GOALS/IAS) No 

 secure.**.treas.gov 3 

 www.iccc.gov 4 

Internal Revenue Service

27 www.irs.gov N/A 

28 eforms.irs.gov N/A 

29 www.employers.gov/index.htm N/A 

30 www.procurement.irs.treas.gov N/A 

31 www.treas.gov/auctions/irs N/A 

U.S. Mint

32 www.usmint.gov Yes 

33 www.cccaconline.org Yes 

Bureau of Public Debt

34 www.publicdebt.treas.gov Yes 

35 arc.publicdebt.treas.gov Yes 

36 www.federalbenefits.gov No 

37 www.cftc.gov No 

 www.treasurydirect.gov 5 

U.S. Secret Service

38 www.treas.gov/usss No 

 badcheck.treas.gov 6 

Office of Thrift Supervision

39 www.ots.treas.gov Yes 

 www.fqcg.gov 7 
Appendix 7 

Management Comments 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 24 
Appendix 7 

Management Comments 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 25 

Note: Attachments have not been included
Appendix 7 

Management Comments 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 26 

Note: Attachment is not included
Appendix 8 

Major Contributors To This Report 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 27 

Office of Information Technology Audits

Clifford H. Jennings, Director, Office of IT Audits 

Ed Coleman, Deputy Director, Office of IT Audits 

Charles Intrabartolo, Computer Specialist 

Barbara Bartuska, IT Auditor 

Office of Audit

Michael S. Stein, Program Analyst, Referencer 
Appendix 9 

Report Distribution 

Management’s Planned Actions For Establishing and Enforcing Web Site 

Practices and Policies Have Not Been Fully Implemented 

 Page 28 

Treasury Departmental Offices

Office of the Deputy Assistant Secretary for Information Systems/Chief 

Information Officer 

Office of Accounting and Internal Control 

Office of Budget 

Office of Management and Budget

Office of Inspector General Budget Examiner