INFORMATION TECHNOLOGY: 

Treasury’s Cyber-Based Critical 

Infrastructure Protection Implementation 

 Efforts Remain Inadequate

OIG-03-093 August 29, 2003

 

Office of Inspector General

******* 

The Department of the Treasury 
Contents 

Audit Report.................................................................................................. 3 

 Results in Brief............................................................................................. 4 

 

 Background ................................................................................................. 7 

Finding and Recommendations ....................................................................... 8 

Treasury Did Not Provide Adequate Guidance Or Effective Oversight On 

 CIP Implementation....................................................................................8

 Recommendations....................................................................................13

Appendices 

Appendix 1: Objective, Scope, and Methodology.........................................16

 Appendix 2: Management Comments.........................................................17 

 Appendix 3: Major Contributors To This Report...........................................22 

 Appendix 4: Report Distribution.................................................................23 

Abbreviations 

 ATF Bureau of Alcohol, Tobacco, and Firearms 

 CIAO Chief Infrastructure Assurance Officer 

 CIO Chief Information Officer 

 CIP Critical Infrastructure Protection 

 CIPAMS Critical Infrastructure Protection Asset Management System 

 CIPO Critical Infrastructure Protection Officer 

 COOP Continuity of Operations Plan 

 DO Departmental Offices 

 DHS Department of Homeland Security 

 DOJ Department of Justice 

 ECIE Economic Council on Integrity and Efficiency 

 E-ITSPA Enterprise Information Technology Security Planning and 

Assurance

 FMS Financial Management Service 

 FY Fiscal Year 

 IT Information Technology 

 MEI Minimum Essential Infrastructure 

 OCIO Office of the Chief Information Officer 

OIG Office of Inspector General 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093) 

Page 1 
Contents 

PCIE President’s Council on Integrity and Efficiency 

 PDD Presidential Decision Directive 

POA&M Plan of Action and Milestones 

 TCIPP Treasury Critical Infrastructure Protection Plan 

 TIPP Treasury Infrastructure Protection Panel 

 Treasury Department of the Treasury 

 TT&E Test, Training, and Exercise 

 USCS United States Customs Service 

USSS United States Secret Service 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093) 

Page 2 
OIG Audit 

Report

The Department of the Treasury 

Office of Inspector General 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation 

Efforts Remain Inadequate (OIG-03-093)

Page 3 

Drew Ladner 

Deputy Assistant Secretary For Information Systems 

and Chief Information Officer 

Department of the Treasury 

The President’s Council on Integrity and Efficiency (PCIE)/Economic 

Council on Integrity and Efficiency (ECIE) Working Group invited 

the Office of Inspector General (OIG) to participate in a 

Government-wide review of agency infrastructure assurance 

programs under Presidential Decision Directive (PDD) 63. As part 

of the review team, the OIG was requested to conduct an audit of 

the Department of the Treasury’s (Treasury) Cyber-Based Critical 

Infrastructure Protection (CIP) Implementation. 

During our audit, we identified that Treasury did not provide 

adequate guidance or effective oversight on CIP implementation to 

the Departmental Offices (DO) or the bureaus. The lack of 

adequate guidance and effective oversight has impeded Treasury’s 

CIP planning and implementation activities. 

The overall objective of this audit was to determine whether 

Treasury adequately implemented its cyber-based CIP plan under 

PDD 63. Fieldwork was conducted at DO, the Financial 

Management Service (FMS), and the United States Customs 

Service (USCS). In addition, a questionnaire was used to solicit 

information from the Bureau of Alcohol, Tobacco, and Firearms 

(ATF) and the United States Secret Service (USSS). A more 

detailed description of our objective, scope, and methodology is 

provided in Appendix 1. 

On November 25, 2002, President Bush signed the bill to establish 

the Department of Homeland Security (DHS). With the formation 

of DHS, certain Treasury CIP cyber assets were transferred to DHS 

and the Department of Justice (DOJ). Due to the transfer of CIP 
cyber assets, we recommend that the issues and recommendations 

identified in this report, which are related to DHS and Justice, be 

effectively communicated to the appropriate officials at DHS and 

DOJ. 

Results in Brief

We noted that Treasury has made progress in its planning efforts 

since our last review.1 Treasury has established the Treasury 

Infrastructure Protection Panel (TIPP), comprised of representatives 

from DO and the bureaus. Treasury’s Assistant Director for CIP, 

who also serves as the Critical Infrastructure Protection Officer 

(CIPO), established a Cyber CIP Working Group, consisting of 

Treasury, DO and bureau designated CIPOs. In addition, Treasury’s 

CIPO developed the Treasury Critical Infrastructure Protection Plan 

(TCIPP), Version 2.0, dated August 30, 2002, which outlines the 

Treasury-wide strategy for developing and implementing its CIP 

program. 

We found that Treasury’s CIP program continues to need 

improvement. Treasury did not provide adequate guidance or

effective oversight on CIP implementation to DO or the bureaus. 

The lack of adequate guidance and effective oversight has impeded 

Treasury’s CIP planning and implementation activities. In 

particular, we noted that: 

1. The TCIPP identified a number of documents and tools as key 

elements to the successful implementation of Treasury’s CIP 

program. However, several of these key elements have not 

been finalized. Specifically, the CIP Implementation Plan, and 

the CIP Management Plan remain in draft. Additionally, the CIP 

Asset Management System (CIPAMS), which is to be used as 

the Treasury-wide tool for tracking the status of CIP cyberbased assets, has not been developed. 

2. The DO and some bureaus have not adequately performed risk 

management activities. At the USCS, a database is maintained 

to track the status of systems vulnerabilities identified. We 

noted that two of the critical cyber-based assets included in the 

 

1 Review of Treasury’s Critical Infrastructure Protection Program, OIG-01-025, dated 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 4 

December 14, 2000. 
database had unresolved issues. The USCS is tracking and 

attempting to resolve these issues. We noted that the USSS 

was in the process of performing certification and accreditation 

for all of its systems and major applications, and risk 

assessments had been conducted for only some of the critical 

cyber-based systems. Within DO, risk assessments had been 

completed for only three of its twelve (25 percent) critical 

cyber-based assets. 

3. Treasury has not fully implemented its emergency management 

plans. We noted that DO and some of the bureaus we reviewed 

had performed testing of their individual emergency 

management capabilities. However, the Treasury’s Emergency 

Management Working Group has not validated those test 

results, and a review of the emergency management program 

has not been conducted throughout Treasury. 

The Treasury CIPO indicated that the Office of the Chief 

Information Officer (OCIO) did not provide the CIP Program Office 

with adequate funds and personnel resources to perform oversight 

and compliance functions. Without adequate resources for its CIP 

implementation, Treasury cannot ensure that potential risks 

resulting from security weaknesses will not disrupt the services its 

critical cyber assets provide for the government, such as revenue 

collection, law enforcement, and financial management. 

Additionally, for the Federal Government to attain its goal of 

achieving full operating capability for protecting the Nation’s critical 

cyber infrastructure by May 2003, every department and agency 

must comply with the requirements of PDD 63. 

Our report includes several recommendations that, in our opinion, 

will assist Treasury in remedying the deficiencies we identified. 

We recommend that the Treasury Chief Information Officer (CIO): 

• Ensure that funds are appropriated and personnel made available 

to enable effective implementation of the TCIPP. 

• Finalize draft documents that are designated as key elements of 

the TCIPP and distribute promptly to DO and the bureaus. 

• Conduct risk assessments for all critical cyber assets, and 

develop plans to address any significant vulnerabilities 

identified. 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 5 
• Develop a process for DO and the bureaus to report to Treasury

on CIP activities, and for Treasury to track the status of 

vulnerabilities identified in critical cyber assets. 

• Conduct a review of cyber disaster recovery capabilities 

throughout Treasury as soon as possible to ensure that the 

continuity of operations (COOP) plan is executable. 

In its response to our draft report, OCIO management generally 

concurred with our findings and recommendations. In addition, 

OCIO management has already commenced efforts to implement 

our recommendations. Their response is summarized and evaluated 

in the body of this report and included, in detail, in Appendix 2, 

Management Comments. 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 6 
Background 

Protection of critical infrastructures remains a high profile issue for 

the Federal Government. President Bush has declared that securing 

the nation’s critical infrastructures is essential to our economic and 

national security and is a priority of his administration. Advances 

in information technology (IT) have caused infrastructures to 

become increasingly automated and inter-linked. These 

advancements have created new vulnerabilities related to 

equipment failures, human errors, weather, and physical and cyber 

attacks.2

 Non-traditional attacks on our infrastructures and 

information systems may be capable of significantly harming our 

economy and military power. 

The policy on CIP, PDD 63, issued May 1998, calls for a national 

effort to assure the security of the nation’s critical infrastructures. 

Critical infrastructures, also known as mission essential 

infrastructures (MEI3

), are those physical and cyber systems 

essential to the minimum operations of the economy and 

government. Every department and agency is required by PDD 63 

to appoint a Chief Infrastructure Assurance Officer (CIAO), who 

shall be responsible for the planning, development, and 

implementation of CIP and assurance requirements. 

The intent of PDD 63 is that by May 2003, the United States shall 

have achieved and shall maintain the ability to protect its critical 

infrastructures from intentional acts that would significantly 

diminish the abilities of: 

• The Federal Government to perform essential national security 

missions and to ensure the general public health and safety. 

 

2 Cyber attacks, or cyber terror, may be defined as the unauthorized electronic access, manipulation, or 

destruction of electronic data or code that is being processed, stored, or transmitted on electronic 

media, having the effect of actual or potential harm to the nation’s critical infrastructure. 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 7 

3

 The National Critical Infrastructure Assurance Office has defined agency MEI as "the framework of 

critical organizations, personnel, systems, and facilities that are absolutely required in order to provide

the inputs and outputs necessary to support the core processes essential to accomplishing an

organization's core mission as they relate to national security, national economic security, or continuity

of government services." 
• The state and local governments to maintain order and to 

deliver minimum essential public services. 

• The private sector to ensure the orderly functioning of the 

economy and the delivery of essential telecommunications, 

energy, financial, and transportation services. 

Treasury’s strategy for protecting its own critical infrastructure is 

summarized in the TCIPP. The TCIPP divides the responsibility for 

CIP among Treasury, DO, and the bureaus. Treasury is responsible 

for the oversight and management of the CIP Program, while DO 

and the bureaus are responsible for the assurance of critical 

infrastructures under their purview. 

Treasury established the TIPP to facilitate and coordinate the 

implementation of TCIPP requirements. The TIPP is comprised of 

representatives from DO and the bureaus, generally the designated 

CIAO. The TIPP is responsible for developing, formulating, 

recommending, and establishing the policies, guidelines, plans, and 

promoting organizational relations for a comprehensive CIP 

program, as outlined in the TCIPP. Treasury’s Enterprise 

Information Technology Security Planning and Assurance (E-ITSPA) 

Office, under the Deputy Assistant Secretary for Information 

Systems and CIO, is charged with developing and overseeing 

security and emergency management programs to protect 

Treasury’s critical infrastructures. 

Finding and Recommendations 

Finding Treasury Did Not Provide Adequate Guidance Or Effective 

Oversight On CIP Implementation 

We found that Treasury did not provide adequate guidance or 

effective oversight on CIP implementation to DO and the bureaus. 

Specifically, certain key documents and tools essential to CIP 

implementation have not been finalized; risk management activities 

have not been adequately performed; and review of the emergency 

management program has not been conducted throughout

Treasury. The lack of adequate guidance or effective oversight has 

impeded CIP planning and implementation activities at Treasury. 

Due to the inability to effectively implement the requirements of 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 8 
PDD 63, Treasury is unable to ensure that potential risks resulting 

from security weaknesses will not disrupt the services it provides 

for the government, such as revenue collection, law enforcement, 

and financial management. In addition, Treasury is unable to 

provide the necessary assurance that cyber attacks on its critical 

infrastructures will not impede its support of national security, 

national economic security, and national public health and safety. 

Key Documents And Tools Essential To CIP Implementation Have 

Not Been Finalized 

The TCIPP indicates that Treasury will rely on certain documents 

and tools to implement its CIP Program. We noted that some 

documents identified as key elements in the TCIPP have not been 

finalized. Specifically, the Treasury CIP Implementation Plan, DO 

and the bureaus’ CIP Management Plans, and the Treasury CIP

Management Plan remain in draft. Additionally, the CIPAMS, 

which will be used as the Treasury-wide tool for tracking the status 

of CIP cyber-based assets, has not been developed. 

Treasury, DO, and the bureaus share the responsibility for 

developing, implementing, and managing the CIP program. While 

Treasury’s E-ITSPA is responsible for oversight and management of 

the program, DO and each bureau are required to develop their own 

CIP Management Plan following the guidance provided in the TCIPP 

and the Treasury CIP Implementation Plan. At the time of our 

review, the Treasury CIP Implementation Plan remained in draft. 

Per the TCIPP, Treasury is to rely on the following key elements to 

implement the Treasury CIP Program: 

• Treasury CIP Implementation Plan - The Treasury CIP 

Implementation Plan, version 1.3 (dated April 24, 2000), 

remains in draft. The CIP Implementation Plan provides 

additional guidance for achieving the Treasury CIP Policy and 

to help DO and the bureaus meet the CIP requirements. 

• DO and Bureaus’ CIP Management Plans - The CIP

Management Plans for DO and the bureaus will address their 

respective CIP-related goals, which should include 

governance, risk management, critical asset management, 

threat assessment, risk assessment, business continuity 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 9 
planning and management, incident reporting and handling, 

and training and awareness. However, neither DO nor the

bureaus we reviewed had received the appropriate guidance 

from Treasury for developing a CIP Management Plan. 

Therefore, neither DO nor the bureaus reviewed has 

completed a CIP Management Plan. 

• Treasury CIP Management Plan - The Treasury CIP 

Management Plan is to focus on such issues as common 

threats, vulnerabilities, and interdependencies identified in 

DO and the bureaus’ CIP Management Plans. The DO and 

the bureaus’ CIP Management Plans form the basis of the 

Treasury CIP Management Plan; and since those have not 

been completed, the Treasury CIP Management Plan remains 

in draft. 

• CIPAMS - The centralized database, CIPAMS, which is to be

used for the collection of consistent and comparable data 

regarding CIP assets, has not been developed. The CIPAMS 

will include critical asset data such as threats and 

vulnerabilities, remediation strategy, estimated cost, and 

remediation schedule. This system will facilitate the 

availability of current and accurate information about the 

status of DO and bureaus’ critical assets.

Risk Management Activities Have Not Been Adequately Performed 

Treasury requires DO and each of the bureaus to develop a risk 

management plan to define and perform activities for their unique 

operations. The risk management plan, as described in the TCIPP, 

encompasses two key components—risk assessment and risk 

mitigation. The risk assessment is used to determine the extent of 

the potential threats and risks associated with an IT system 

throughout its life cycle. Risk mitigation is the process of 

prioritizing, evaluating, and implementing the appropriate 

risk-reducing controls recommended from the risk assessment 

process. 

The DO and some of the bureaus have not adequately performed 

risk management activities necessary to protect their critical cyber 

assets. We noted that the USCS maintains a database to track the 

status of vulnerabilities identified for its cyber-based assets. The 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 10 
database contains background information on the vulnerabilities, as 

well as mitigation plans and the status of the plans. We found that 

the database included two critical cyber-based assets for which 

certain vulnerabilities were identified, but mitigation plans had not 

been developed. The USSS was in the process of performing 

certification and accreditation of all of its systems and major 

applications; and at the time of our review, risk assessments had 

been conducted for only some systems. Within DO, risk mitigation 

plans had been completed for only three of its twelve (25 percent) 

critical cyber-based assets. Without conducting risk assessments 

for critical assets and completing risk mitigation plans to address 

identified vulnerabilities, Treasury will not be aware of the potential 

risks and weaknesses related to its critical assets. 

We noted that DO and the bureaus are required to report critical 

asset data to Treasury’s CIPO. However, the CIPO indicated that 

the CIP Program Office did not have sufficient personnel or tools to 

ensure that DO and the bureaus comply with those requirements. 

According to the CIPO, the CIP Program Office has been focusing 

on program management activities, such as developing guidance 

and policy documents. Furthermore, the CIPAMS, which will 

collect data on vulnerabilities associated with CIP assets, has not 

been developed. 

Emergency Management Plans Have Not Been Fully Implemented 

Despite on-going activities to improve Treasury’s IT security 

program, the OCIO has not fully implemented its emergency 

management program. While DO and some of the bureaus have 

tested various aspects of their respective emergency plans, a 

comprehensive test of the cyber CIP disaster recovery capabilities 

throughout Treasury has not been conducted. Without conducting 

a comprehensive test of the emergency management plan, 

Treasury cannot ensure that DO and the bureaus have viable COOP 

capabilities. Treasury lacks adequate personnel resources to 

coordinate and oversee the emergency management activities 

throughout Treasury. 

Treasury’s draft Emergency Management Test, Training and 

Exercise (TT&E) Program policy states that the goal of the program 

is to “ensure, as a baseline of preparedness, that the Department 

has in place a viable COG [continuity of Government] and COOP 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 11 
capability that ensures the performance of its essential functions 

during any emergency or situation...” One of the goals of the 

TT&E Program is to conduct “testing and exercising of the COOP 

plans and procedures to test and exercise interoperability between 

and among Treasury HQ [headquarters] and bureau COOP teams, 

as well as to test and exercise the ability of these COOP teams to 

perform their essential functions and operate from their AOFs 

[alternate operating facilities].” The TT&E Program policy 

emphasizes that the goal of having a successful TT&E Program in 

place is “possible only if training and exercising are conducted on a 

regular schedule....” Per the National Institute of Standards and 

Technology’s Generally Accepted Principles and Practices for 

Securing Information Technology Systems, an organization should 

test and revise the emergency plan. 

The lack of adequate guidance and effective oversight is attributed 

largely in part to the fact that Treasury has not adequately funded 

its current PDD 63 effort. The OIG has previously reported on 

inadequate funding and resources being devoted to Treasury’s CIP 

Program4

. Treasury committed funds in Fiscal Year (FY) 2002 for 

CIP planning activities and to implement the strategy detailed in the 

TCIPP. However, not all of the funds committed were actually 

provided to the CIP Program Office. Treasury’s report on IT 

spending, (Exhibit 53), appropriated $5.7 million for Treasury-wide 

CIP activities in FY 2002. However, only $1.5 million was 

received for the CIP Program in FY 2002. Consequently, some CIP 

activities planned during the year were not undertaken. For 

example, although $1.7 million was slated for oversight capability, 

none of the funds that were received went toward oversight. 

Additionally, only $300,000 of the $910,000 earmarked for 

vulnerability tools/test lab was received. 

In addition to inadequate funding for CIP Implementation at 

Treasury, there are limited personnel resources devoted to CIP 

Program activities. At the time of our review, the cyber CIP 

Program Office at Treasury consisted of only two personnel, 

including the CIPO. The CIP Program Office has identified that two 

additional personnel were needed to accomplish the mission of the 

program, but requests made by the CIP Program Office to 

 

4

 Review of Treasury’s Critical Infrastructure Protection Program, OIG-01-025, dated 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 12 

December 14, 2000. 
Treasury’s E-ITSPA Director for the additional personnel have been 

declined. 

Recommendations 

Treasury’s CIO should: 

1. Ensure that funds are appropriated and personnel made available 

to enable effective implementation of the TCIPP.

Management Response: 

OCIO management concurred with our recommendation. 

Although the staff supporting the Treasury-wide CIP program

was divested to DHS, the OICO remains committed to ensuring 

that the necessary personnel and funds will be allocated for the 

CIP program. OCIO management recently justified continued 

appropriated funding for FY 2004 funding for the CIP program. 

2. Finalize draft documents that are key elements of the TCIPP and 

distribute them to DO and the bureaus, ensuring that DO and 

the bureaus have the necessary guidance to comply with 

PDD 63 requirements.

Management Response: 

OCIO management concurred with our recommendation. 

Documents identified as key elements of the TCIPP were either 

finalized and distributed to the bureaus, or are currently in the 

process. Also, the Treasury CIP policy was incorporated into 

Treasury’s comprehensive IT Security Policy manual and 

distributed to the bureaus in June 2003. The draft Treasury CIP 

Implementation Plan was updated as of February 24, 2003; 

however, OCIO management is in the process of determining 

the applicability of issuing the document given the new 

direction of the National CIAO. Finally, OCIO management 

plans to develop the Treasury CIP Management Plan after they

have conducted Project Matrix Step 2. 

3. Conduct risk assessments for all critical cyber assets, and 

develop plans to address the significant vulnerabilities identified 

in order to mitigate security exposures. 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 13 
Management Response: 

OCIO management generally concurred with our 

recommendation. All bureaus having critical cyber assets are 

required to develop plans to address significant vulnerabilities. 

These vulnerabilities should be addressed through Treasury’s 

requirement for all systems being certified and accredited. Any 

vulnerability identified during the certification and accreditation 

process is tracked with the Department’s Plan of Action and 

Milestones (POA&M) reporting procedures. OCIO management 

plans to identify CIP cyber assets separately in its POA&M 

reporting. 

4. Develop a process for DO and bureaus to report to Treasury on 

CIP activities and for Treasury to track the status of 

vulnerabilities identified in critical cyber assets. 

Management Response: 

OCIO management generally concurred with our 

recommendation. OCIO management plans to track the status 

of vulnerabilities identified for CIP cyber assets through the 

POA&M reporting process. Confirmation that appropriate action 

has occurred will be assured through the Security Oversight and 

Compliance Program. 

5. Conduct a review of cyber disaster recovery capabilities 

throughout Treasury as soon as possible to ensure the COOP

plan is executable. 

Management Response: 

A security program review of each bureau’s IT security program 

is nearing completion to meet an instituted FY 2003 CIO 

oversight goal. Reviewing each bureau’s cyber disaster 

recovery capability is an integral part of the security program 

review. The Emergency Preparedness Office, under the 

direction of the Senior Advisor to the Assistant Secretary for 

Management / Chief Financial Officer, has met with the bureaus 

and received individual bureau COOP plans for review. The 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 14 
Emergency Preparedness Office has the vital function of 

monitoring the execution of the bureaus’ COOP plans. 

OIG Comment:

The OIG agrees that the formal steps Treasury management has 

taken, and plans to take, satisfy the intent of the 

recommendations. 

* * * * * * 

I would like to extend our appreciation to the Treasury for the 

cooperation and courtesies extended to my staff during the review. 

If you have any questions, please contact me at (202) 927-5774, 

or Joseph Maranto, Audit Manager, at (202) 927-0191. Major 

contributors to this report are listed in Appendix 3. 

/s/ 

Louis C. King 

Director, Information Technology Audits 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 15 
Appendix 1 

Objective, Scope, and Methodology 

The overall objective of this review was to determine whether 

Treasury has adequately implemented its cyber-based CIP plan 

under PDD 63. Specifically, we determined the adequacy of 

Treasury’s implementation activities in the following areas: (1) risk 

mitigation; (2) emergency management; (3) interagency 

coordination; (4) resource and organization requirements; and 

(5) recruitment, education, and awareness. 

Our work was part of a larger effort by the PCIE/ECIE to monitor 

CIP programs across the Federal Government. To allow our results 

to be consolidated with those of other Federal Agency Offices of 

Inspector General and reported on a Government-wide basis, we

used the PCIE/ECIE Review Guide, Phase II, dated April 2002.

We identified 18 critical cyber assets as our audit universe, based 

upon our review of Treasury’s Project Matrix Step 1 Report, dated 

October 2000. The components with critical cyber assets were 

selected for review. Fieldwork was performed at the Treasury 

OCIO, DO, FMS, and the USCS from October through December 

2002. Additionally, an audit questionnaire was used to solicit

information on implementation activities at ATF and the USSS. 

We conducted our audit in accordance with generally accepted 

government auditing standards. 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 16 
Appendix 2 

Management Comments 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 17 
Appendix 2 

Management Comments 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 18 
Appendix 2 

Management Comments 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 19 
Appendix 2 

Management Comments 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 20 
Appendix 2 

Management Comments 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 21 
Appendix 3 

Major Contributors To This Report

Office of Information Technology Audits

Edward G. Coleman, former Director, Office of IT Audits 

Joseph Maranto, IT Audit Manager 

Patrick Nadon, IT Audit Manager 

Sandra Turgott, Team Lead 

Richard Kernozek, IT Auditor 

Anthony Nicholson, IT Auditor 

Angela Payton, Computer Specialist 

Tram Do, Referencer 

Kenneth Harness, Referencer 

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 22 
Appendix 4 

Report Distribution 

The Department of the Treasury

Office of the Deputy Assistant Secretary for Information 

Systems/Chief Information Officer 

Enterprise IT Security Planning and Assurance 

Office of Accounting and Internal Control

Office of Management and Budget

Office of Inspector General Budget Examiner 

Other

President's Council on Integrity and Efficiency

Treasury’s Cyber-Based Critical Infrastructure Protection Implementation

Efforts Remain Inadequate (OIG-03-093)

Page 23