OFFICE OF

INSPECTOR GENERAL

Audit Report

 

OIG 2017 Evaluation of the

Farm Credit Administration’s 

Compliance with the

Federal Information Security 

Modernization Act

A-17-05

Issued October 27, 2017 

FARM CREDIT ADMINISTRATION
OBJECTIVE:

The objectives of this evaluation 

were to determine the 

effectiveness of the Farm Credit 

Administration’s (FCA or Agency)

information security programs 

and practices and to provide the 

OIG with the ability to report the 

results to the Office of 

Management and Budget (OMB) 

and the U.S. Department of 

Homeland Security (DHS). 

BACKGROUND:

FCA is an independent Federal 

agency responsible for 

regulating, examining, and 

supervising the Farm Credit 

System and the Federal 

Agricultural Mortgage 

Corporation. The mission of the 

agency is to ensure a safe,

sound, and dependable source 

of credit and related services 

for agriculture and rural 

America. 

The FCA Board approved the 

formulation of the Office of 

Information Technology (OIT) in 

May 2015. The OIT is 

responsible for all aspects of 

technology, including IT 

infrastructure and applications 

development, maintenance and 

support, data collection, and IT 

security services.

The Federal Information Security Modernization Act of 2014 (FISMA) 

requires Inspectors General or an independent external auditor, as 

determined by the Inspector General of the agency, to perform an 

annual evaluation of their agency’s security program and practices. For 

fiscal year 2017, FCA Office of Inspector General (OIG) contracted 

with Brown & Company CPAs and Management Consultants, PLLC 

(Brown & Company) to conduct the independent evaluation of FCA’s 

compliance with the provisions of FISMA. 

FISMA requires agencies to develop, document, and implement an 

agency-wide information security program to provide information 

security for the information and information systems that support the 

operations and assets of the Agency, including those provided or 

managed by another agency, contractor, or other source.

Brown & Company concluded that FCA's information security 

program is generally compliant with the FISMA legislation and 

applicable OMB guidance. FCA continued to make positive strides in 

addressing information security weaknesses. Brown & Company 

found that FCA’s information security program was effective and 

provided reasonable assurance of adequate security.

However, Brown & Company identified for improvement three 

control weaknesses related to FCA security practices. The weaknesses 

were in the areas of identity management, configuration 

management, and incident response. OIT agreed to take corrective 

action on four recommendations related to these three weaknesses.

Brown & Company’s report contains sensitive information about FCA 

and potential vulnerabilities that could be used against the Agency; 

therefore, the OIG is not releasing the full report publicly. 
FARM CREDIT ADMINISTRATION

OFFICE OF INSPECTOR GENERAL

Report Fraud, Waste, Abuse, Mismanagement

Phone: Toll Free (800) 437-7322; (703) 883-4316

Fax: (703) 883-4059

E-mail: fca-ig-hotline@rcn.com

Mail: Farm Credit Administration

Office of Inspector General

1501 Farm Credit Drive

McLean, VA 22102-5090