We reported that several contractor sites lacked fully documented, comprehensive entity-wide security plans that addressed all aspects of an adequate security program. Inadequate risk assessments, a lack of comprehensive security awareness programs, and inadequate policies were among the weaknesses noted at the contractors. Systems Software Controls Systems software controls help to prevent unauthorized individuals from using software to read, modify, or delete critical information and programs. Systems software is a set of programs designed to operate and control the processing activities of computer equipment. Generally, it supports a variety of applications that may run on the same computer hardware.
Some systems software can change data and programs on files without leaving an audit trail.
Weaknesses in systems software controls related to managing routine changes to the software to ensure their appropriate implementation and configuring operating system controls to ensure their effectiveness. Such problems could weaken critical controls over access to sensitive Medicare data files and operating system programs. Since FY 1997, we have reported that the Medicare data centers have inappropriate access to the source code of the Fiscal Intermediary Shared System, which is used by certain Medicare contractors. This unresolved weakness was expanded this year to include the Common Working File system, which all shared systems use to obtain authorization to pay claims. Access to source code renders the Medicare claim processing system vulnerable to abuse, such as the implementation of unauthorized programs and the implementation of local changes to shared system programs.