In addition to these efforts, the Principal Deputy Assistant Secretary for Information and Technology reemphasized the commitment of his information security program office to strengthening the overall security posture of VA, including the categories of control weaknesses found at the VBA facilities. He stated that his office would provide whatever manner of assistance that is needed to VBA to facilitate correction of these significant security control weaknesses. Our evaluation of the AIS security management program at one VISN, and testing at four health care systems by the OIG and the General Accounting Office found wide-spread AIS security control weaknesses. A comprehensive computer security management program. A security plan that was risk based.
Access controls to network and main computer systems.
Management of network user identifications and passwords. Monitoring network system activity. Comprehensive physical security controls. Contracting for additional penetration testing and risk assessments. Follow-up testing to ensure local facilities have implemented prior recommendations.