LEON SNEAD Cm!fied Publ1c AuountanLS 

&COM ~P.C.--------------------------------------------------------- a~ ~ ___ wta~ __ 

416 Hungerford Dm-e Swte 400 

Roc~'llle. ~d 20850 

301-738-8190 

£ax 30 ]. 738-8210 

leonsnead.companypc@erols.com 

Inspector General 

Federal Election Commission 

999 E Street, NW, 

Washington, DC 20463 

December 9, 2014 

In response to your request, we perfonned additional audit tests to determine whether 

agency officials had implemented corrective actions relating to six recommendations 

from our 20 13 financial statement audit, and whether these actions were sufficient to 

consider the recommendations closed. 

We performed our audit work during the period December 1 through December 5, 2014, 

at the Federal Election Commission (FEC) offices. We completed our follow-up testing 

for five of the six recommendations. For these five recommendations, we determined 

that the actions taken by FEC officials were sufficient to consider them closed. As 

agreed with members of your staff, we completed supporting working papers and filed 

them on the FEC network. We also retained a copy of these working papers. 

We were not able to complete sufficient tests to close out recommendation 19. FEC 

experienced a network outage for over one and a half days which prohibited access to 

the agency's network. As a result, FEC personnel could not provide the data requested 

when due at noon on December 3rd. However, the data was subsequently provided 

in the afternoon of December 5th. We attempted to make a determination on this 

recommendation from the data provided but needed additional information to support a 

detennination as to whether the recommendation could be closed, such as documentation 

to support corrections of prior scanning vulnerabilities. Therefore, recommendation 19 

will remain open and the additional documentation will be requested during the auditfollow up period for the agency's fiscal year 2015 audit. 

The table on the following page summarizes the recommendations reviewed, the actions 

taken by FEC officials, and our conclusions on these recommendations. 

We appreciate the courtesies and cooperation provided by FEC personnel during this 

review. 

I ..... . ~----...,'tf ~~M ,_,7' fk:- ~snead & Company, P.C. 
RECOMMENDATIONS REVIEWED 

Ret. Audit Recommendation Summary or Actions Taken by Audit Conclusions 

No. FEC 

7 Revise all pertinent F'EC policies and F'EC issued several new policies We analyzed the 

procedures to ensure that they address and procedures, and updated documentation provided by 

proper prevention and detection controls, others that provide appropriate FEC on this recommendation, 

and provide a current and authoritative guidance on detection., and concluded that actions 

control structure for addressing APT, and prevention, and eradication of taken were sufficient to close 

other types of intrusions. Ensure that this APT and malware. this recommendation. 

review is completed, and policies and 

procedures are issued by March 2014. 

12 Revise F'EC policies and operating F'EC issued a new procedure, and We analyzed the 

procedures to require the minimum best updated another that noted that documentation provided by 

practices controls contained in the the agency has adopted the FEC on this recommendation, 

Federal Desktop Core Configuration USOCB configuration standards and concluded that actions 

(FDCC) and the United Stales as the core set of configuration taken were sufficient to close 

Government Configuration Baseline standards for the agency. this recommendation. 

(USOCB) for those systems that require 

user identification and passwords. 

l3 Undertake a comprehensive review of FEC undertook a review of We analyzed the 

user accounts that have been granted accounts with nonexpiring documentation provided by 

nonexpiring passwords. Require detailed passwords, and established new FEC on this recommendation., 

infonnation from account owners on the procedures that require all and concluded that actions 

need for non-expiring accounts, including accounts that use passwords to taken were sufficient to close 

the development of other alternatives, have passwords that expire. New this recommendation. 

before reauthorizing the accounts' access. policies have been issued to 

Develop F'EC policies and operating provide guidance in this area. 

procedures to implement this 

recommendation. 

14 Whenever possible, require accounts with FEC has established procedures We analyzed the 

non-etpiring passwords to be changed at relating to service accounts that documentation provided by 

least annually. Establish substantially require the accounts to have FEC on this recommendation, 

more robust password requirements for passwords that expire every 180 and concluded that actions 

accounts granted non-etpiring passwords. days. As discussed for taken were sufficient to close 

Develop FEC policies and operating recommendation 13, F'EC bas this recommendation. 

procedures to implement this issued guidance in this area. 

recommendation. 

15 Immediately tenninate those accounts FEC disabled any account that We analyzed the 

with non-expiring passwords that have was inactive for 12 months, and documentation provided by 

not accessed their accounts within the last as discussed above now requires FEC on this recommendation, 

12 months. Develop FEC policies and these accounts to have passwords and concluded that actions 

operating procedures to implement this that expire in J 80 days. taken were sufficient to close 

recommendation to include a data Procedures have been issued as this recommendation. 

retention policy for historical data. discussed for recommendation 

13. 

19 Strengthen controls to ensure that Network problems for one and Due to not receiving the 

vulnerabilities/weaknesses identified one-half days, due to issues with requested documentation until 

through the vulnerability scanning tests one of the agency's contractors, late December S, we could 

are completed within 60 days of prevented FEC from providing not complete our testing of 

identification., or document an analysis information on our initial data this recommendation as 

and acceptance of risks for longer term request related to this further information was 

remediation. recommendation until after LSC needed. Therefore, we were 

departed FEC offices. unable to determine wbetbec 

the recommendation could be 

closed 

2