type: other

jurisdiction: US

text: b' U.S. Department of Agriculture\n\n Office of Inspector General\n Southwest Region\n\n\n\n\n Audit Report\n\n Management and Security of\n Economic Research Service\nInformation Technology Resources\n\n\n\n\n Report No. 14099-1-Te\n March 2004\n\x0c UNITED STATES DEPARTMENT OF AGRICULTURE\n\n OFFICE OF INSPECTOR GENERAL\n\n\n Washington, DC 20250\n\n\n\n\nDATE: March 31, 2004\n\nREPLY TO\nATTN OF: 14099-1-Te\n\nSUBJECT: Management and Security of Economic Research Service\n Information Technology Resources\n\nTO: Susan Offutt\n Administrator\n Economic Research Service\n\nATTN: Paul Chan\n Director\n Information Services Division\n\n\nThis report presents the results of the subject audit. Your response to the official draft report,\ndated March 30, 2004, is included in its entirety as exhibit A with excerpts and the Office of\nInspector General\xe2\x80\x99s position incorporated into the Findings and Recommendations section of the\nreport. Your response contained sufficient justification to reach management decisions on all\nrecommendations contained in the report.\n\nPlease follow Departmental and your internal agency procedures in forwarding final action\ncorrespondence to the Office of the Chief Financial Officer, Director, Planning and\nAccountability Division. Final action on the management decisions should be completed within\n1 year of the date of the management decisions to preclude being listed in the Department\xe2\x80\x99s\nannual Performance and Accountability Report.\n\nWe appreciate the courtesies and cooperation extended to us by members of your staff during the\naudit. If you have any questions, please contact me at 720-6945, or have a member of your staff\ncontact Richard J. Davis, Director, Administration and Finance Division, at 720-1918.\n\n\n\n/s/ R. W. Young\nROBERT W. YOUNG\nAssistant Inspector General\n for Audit\n\x0cExecutive Summary\nManagement and Security of Economic Research Service Information Technology\nResources (Audit Report No. 14099-1-Te)\n\nResults In Brief Effective management and security of information technology (IT) resources\n have become increasingly important to the U.S. Department of\n Agriculture\xe2\x80\x99s mission, especially as the Department makes more programs\n and information available over the Internet. In our continuing effort to\n examine Information System Security Programs (ISSP) throughout the\n Department, we audited the management and security of Economic Research\n Service\xe2\x80\x99s (ERS) IT resources.\n\n Specifically, our objectives were to (1) assess the overall management of\n ERS\xe2\x80\x99 ISSP, (2) determine the adequacy of security over agency networks,\n and (3) determine if adequate logical and physical access controls existed to\n protect computer resources, including application and system software,\n against unauthorized modification, disclosure, loss, or impairment.\n\n As the chief source of the Department\xe2\x80\x99s economic research and information,\n ERS manages a large volume of data, some of it sensitive. For example, its\n computer systems contain social security numbers and farm income and\n expenditure records belonging to individuals. Protecting such confidential\n information from cyber intruders must be a top priority for management and\n staff.\n\n We found that ERS needs to strengthen its ISSP by establishing controls and\n formal policies for oversight of security planning, periodic review of security\n controls, administration of IT security tools, and logical and physical access.\n\n Foremost, insufficient security planning and oversight created an unstable\n foundation for the agency\xe2\x80\x99s ISSP. Although the Office of the Chief\n Information Officer had waived the requirement to submit agency security\n plans in 2002, agencies still were required to ensure that all weaknesses\n identified in the 2001 security plan reviews were corrected. However, we\n found that ERS had not updated its 2001 security plan to incorporate all\n requirements. Furthermore, the agency had not implemented all of its\n security plans to comply with Federal regulations. For example, ERS had not\n implemented a formal computer security training program, obtained security\n clearances for employees in sensitive positions, established a formal incident\n response policy, or completed and tested a contingency plan.\n\n If it had routinely reviewed its ISSP, ERS could have discovered and\n remedied many of the flaws we identified in its security plan and access\n control procedures. However, ERS had not complied with Federal\n information resource policies, which require agencies to conduct annual\n security reviews and perform risk analyses at least every 3 years. ERS had\n\nUSDA/OIG-A/14099-1-Te Page i\n\x0c no formal program for periodically evaluating its security policies and\n conducting risk assessments to determine the extent of potential risks and\n threats to its IT resources.\n\n Inadequate administration of IT security tools also left ERS systems open to\n malicious attacks, a material control weakness that requires additional\n management oversight. Our vulnerability scan of the agency\xe2\x80\x99s computer\n systems disclosed a large number of risk indicators that could be exploited by\n cyber attackers. While ERS took immediate action to remedy some of the\n weaknesses we identified in our audit, it had not responded aggressively to\n other security vulnerabilities discovered 10 months earlier by its own\n vulnerability scan.\n\n Finally, ERS\xe2\x80\x99 logical and physical access controls did not provide optimum\n protection against unauthorized modification, disclosure, loss, or impairment\n of IT resources. We found that computer access lists had not been updated to\n reflect current users, controls over shared or generic accounts had not been\n established, users could transmit sensitive data through unsecured remote\n access methods, settings for password uniqueness and logon attempts did not\n meet Departmental guidelines, and cleaning staff and other unauthorized\n individuals had physical access to sensitive areas and equipment.\n\nRecommendations\nIn Brief We recommend that ERS plan and/or implement a formal training program,\n background screening of all individuals in sensitive positions, a formal\n incident response policy, and a contingency plan that is approved by senior\n management and tested annually. We further recommend that the agency\n establish formal procedures for periodic review of security controls and risk\n assessments.\n\n Additionally, we recommend that ERS take immediate corrective action to\n mitigate all high- and medium-risk vulnerabilities, and that it establish\n policies to strengthen network security. We recommend that these policies\n address (1) proper scanning procedures to detect all network vulnerabilities,\n (2) proper configuration of computer access security settings, (3) a\n configuration management program, (4) modem security, (5) routine and\n timely review of firewall configuration, and (6) logical and physical access\n controls, including controls over computer access lists, accounts, and\n sensitive areas and equipment.\n\nAgency Response\n In a letter dated March 30, 2004, ERS concurred with all of the findings and\n recommendations and provided proposed actions and completion dates for\n each recommendation. (See exhibit A.)\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page ii\n\x0cOIG Position\n We accept the management decisions for all of the recommendations\n contained in the report. For final action, ERS needs to provide the Director,\n Planning and Accountability Division, Office of the Chief Financial Officer\n (OCFO/PAD), documentation as outlined in the Office of Inspector\n General (OIG) Position sections of the report.\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page iii\n\x0cAbbreviations Used In This Report\n\nADP Automated Data Processing\nDM Departmental Manual\nDR Departmental Regulations\nERS Economic Research Service\nISD Information Services Division\nISSP Information Systems Security Program\nISSPM Information Systems Security Program Manager\nIT Information Technology\nLAN Local Area Network\nNIST National Institute of Standards and Technology\nOCIO Office of the Chief Information Officer\nOCFO/PAD Office of the Chief Financial Officer, Director,\n Planning and Accountability Division\nOIG Office of Inspector General\nOMB Office of Management and Budget\nSP Special Publication\nUSDA U.S. Department of Agriculture\nWAN Wide Area Network\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page iv\n\x0cTable of Contents\nExecutive Summary .................................................................................................................................i\n\nAbbreviations Used In This Report......................................................................................................iv\n\nBackground and Objectives ................................................................................................................... 1\n\nFindings and Recommendations............................................................................................................ 3\n\n Section 1. ERS Has Not Ensured Compliance With Federally Mandated Security Guidelines\n and Is Lacking In Its Overall Management of IT Resources................................. 3\n\n Finding 1 ERS\xe2\x80\x99 Security Plan Was Incomplete and Not Fully Implemented ......................... 3\n Recommendation No. 1.................................................................................... 9\n Recommendation No. 2.................................................................................... 9\n Recommendation No. 3.................................................................................. 10\n Recommendation No. 4.................................................................................. 10\n Recommendation No. 5.................................................................................. 11\n Finding 2 ERS Needs a Formal Program to Periodically Review Security Controls............ 11\n Recommendation No. 6.................................................................................. 12\n Recommendation No. 7.................................................................................. 13\n\n Section 2. Network Security ........................................................................................................... 14\n\n Finding 3 Vulnerabilities Expose ERS Systems to the Risk of Attacks................................ 14\n Recommendation No. 8.................................................................................. 19\n Recommendation No. 9.................................................................................. 19\n Recommendation No. 10................................................................................ 20\n Recommendation No. 11................................................................................ 20\n Recommendation No. 12................................................................................ 21\n Recommendation No. 13................................................................................ 21\n\n Section 3. Access Controls .............................................................................................................. 22\n\n Finding 4 ERS Needs to Strengthen Its Access Controls ...................................................... 22\n Recommendation No. 14................................................................................ 26\n Recommendation No. 15................................................................................ 26\n Recommendation No. 16................................................................................ 27\n Recommendation No. 17................................................................................ 27\n\nScope and Methodology........................................................................................................................ 28\n\nExhibit A \xe2\x80\x93 Agency Response .............................................................................................................. 29\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page v\n\x0cBackground and Objectives\nBackground Information security, improving the overall management of information\n technology (IT) resources, and the transition to electronic business\n (e-Government) have emerged as top priorities within the U.S. Department\n of Agriculture (USDA). As technology enhances our ability to share\n information instantaneously among computers and networks, it also has\n made organizations more vulnerable to unlawful and destructive penetration\n and disruptions. These vulnerabilities pose a threat to the sensitive and\n critical operations of the Economic Research Service (ERS).\n\n Various laws have emphasized the need to protect agencies\xe2\x80\x99 sensitive and\n critical data, including the Privacy Act of 1974, the Computer Security Act\n of 1987,1 and the Paperwork Reduction Act of 1995. Responsibilities\n regarding information security were reemphasized in the Clinger-Cohen Act\n of 1997 and Presidential Decision Directive 63, Policy on Critical\n Infrastructure Protection. Additionally, the Government Information\n Security Reform Act1 enacted on October 30, 2000, essentially codifies the\n existing requirements of the Office of Management and Budget (OMB)\n Circular A-130.2\n\n OMB Circular A-1302 establishes policy for the management of Federal\n IT resources. The policy requires security commensurate with the risk and\n magnitude of the harm resulting from the loss, misuse, or unauthorized\n access to, or modification of information. The policy also requires\n assignment of security responsibility, security plans, risk assessments, and\n system certifications to lessen the risk and magnitude of damage to\n information.\n\n Considerable guidance on information security also has been developed. The\n National Institute of Standards and Technology (NIST) has issued numerous\n Federal Information Processing Standards, as well as a comprehensive\n description of basic concepts and techniques in Special Publication (SP)\n 800-12, An Introduction to Computer Security: The NIST Handbook, dated\n October 1995, and SP 800-14, Generally Accepted Principles and Practices\n for Security Information Technology Systems, dated September 1996.\n\n Finally, Departmental Manual (DM) 3140-1.1, Management ADP Security\n Manual, dated July 19, 1984, also provides standards, guidelines, and\n procedures for the development and administration of automated data\n processing (ADP) security programs mandated by Departmental\n regulations (DR).\n\n\n1\n Federal Information Security Management Act of 2002 replaced Government Information Security Reform Act and Computer Security Act of 1987.\n2\n OMB Circular A-130, appendix III, Security of Federal Automated Information Resources, dated November 30, 2000.\n\nUSDA/OIG-A/14099-1-Te Page 1\n\x0c Located in Washington, D.C., and staffed by about 450 employees, ERS is\n the main source of economic information and research for USDA. The\n mission of ERS is to inform public and private decision makers on economic\n and policy issues related to agriculture, food, natural resources, and rural\n development. Three ERS divisions, Food and Rural Economics, Market and\n Trade Economics, and Resource Economics, publish a wide variety of\n research reports and periodicals. To support these activities, the Information\n Services Division (ISD) manages and directs agencywide IT and\n communication activities by building and maintaining powerful analytical\n and communications environments as well as data dissemination systems to\n deliver agency products.\n\n ERS\xe2\x80\x99 IT resources include a local area network (LAN) and two mission\n business systems, systems A and B. The LAN consists of workstations and\n servers that provide employees with office software, Internet access, and\n e-mail. While some sensitive data files reside on the LAN, most of the\n information is obtained from public sources, such as universities, State\n governments, other Federal agencies, and foreign governments, and typically\n pertains to crops, acreage, yield, cost and returns, situation and outlooks, and\n farm labor. Systems A and B, however, contain more sensitive information,\n including social security numbers and farm income and expenditures data\n tied to individuals. To protect the integrity and security of these computer\n systems, ERS uses logical access controls, such as computer passwords, and\n physical security measures to prevent incidental or malicious damage to its\n IT resources.\n\n While the Internet was designed as an open system with no regard for\n security, new security standards are continually being developed, and\n safeguards such as encryption, data backup procedures and controls, network\n intrusion detection systems, and disaster recovery and contingency planning\n can be employed to afford some degree of security.\n\nObjectives The objectives of this audit were to (1) assess the overall management of\n ERS\xe2\x80\x99 Information Systems Security Programs (ISSP), (2) determine the\n adequacy of security over agency networks, and (3) determine if adequate\n logical and physical access controls exist to protect computer resources,\n including application and system software, against unauthorized\n modification, disclosure, loss, or impairment.\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page 2\n\x0cFindings and Recommendations\nSection 1. ERS Has Not Ensured Compliance With Federally Mandated Security\nGuidelines and Is Lacking In Its Overall Management of IT Resources\n\n As the foundation of USDA ISSP, security planning and management reflect\n senior management\xe2\x80\x99s commitment to addressing security risks. Without a\n well-designed program, an agency\xe2\x80\x99s security controls may be inadequate or\n inconsistently applied, and employee responsibilities may be unclear,\n misunderstood, and improperly implemented.\n\n Through the Computer Security Act of 1987, Congress called for\n establishing minimum acceptable security practices for Federal computer\n systems. The Computer Security Act of 1987 requires agencies to identify\n and protect systems containing sensitive information and calls for a\n computer standards program and security training. Accordingly,\n OMB Circular A-1302 established a minimum set of controls for agencies\xe2\x80\x99\n automated information security programs, including assignment of security\n responsibility, security planning, periodic review of security controls, and\n management authorization of systems to process information.\n\n Based on our review of ERS\xe2\x80\x99 security program, we concluded that the\n agency needs to improve its management of IT resources, and ensure\n compliance with existing Federal requirements for managing and securing\n IT resources. Specifically, ERS has not adequately planned for network\n security and conducted the necessary risk assessments of its network. We\n attributed these weaknesses to a need for additional management oversight.\n As a result, ERS\xe2\x80\x99 lack of compliance is a material internal control weakness,\n and its ability to accomplish its mission may be jeopardized if it cannot\n properly manage its IT infrastructure.\n\n\n\nFinding 1 ERS\xe2\x80\x99 Security Plan Was Incomplete and Not Fully Implemented\n\n ERS\xe2\x80\x99 security plan did not meet federally mandated security requirements.\n Although the Office of the Chief Information Officer (OCIO) had waived\n the requirement to submit agency security plans in 2002, agencies still were\n required to ensure that all weaknesses identified in the 2001 security plan\n reviews were corrected. However, at the time of our review, ERS had not\n updated its 2001 security plan to incorporate all security requirements and\n had not implemented some of its security plan. These conditions existed\n because ERS had not assessed its ISSP and not implemented controls to\n ensure that security planning met requirements. As a result, ERS had no\n assurance that its security planning adequately protected its IT resources.\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page 3\n\x0c OMB Circular A-1302 states that security plans should establish rules for\n employee behavior, a training program for computer security, personnel\n controls, an incident response policy, a contingency program, technical\n security controls, and system interconnectivity rules.\n\n We reviewed ERS\xe2\x80\x99 fiscal year 2001 security plan and found that many of\n the policies it prescribed had not been implemented. For example,\n ERS\xe2\x80\x99 security plan established policies for security awareness training,\n screening individuals, incident handling, and contingency planning. At the\n time of our review, however, ERS had not implemented a formal computer\n security training program, obtained security clearances for employees in\n sensitive positions, established a formal incident response capability, or\n completed and tested a contingency plan.\n\n Training\n\n While the ERS security plan addressed computer security awareness\n training, ERS had not provided that training to all employees with access to\n the agency\xe2\x80\x99s computer system. ERS also had not implemented a formal\n training program to include controls to ensure that employees receive\n specialized training commensurate with their responsibilities.\n\n Consequently, ERS had not complied with the Computer Security Act\n of 1987, which directs all agencies to provide mandatory periodic training in\n computer security awareness and accepted computer security practices for\n all employees who manage, use, or operate Federal computer systems within\n or under the supervision of that agency. OMB Circular A-1302 requires that\n agency security plans establish controls to ensure that all individuals receive\n appropriate training in how to fulfill their computer security responsibilities\n before they are allowed to access the system. Such training may vary from a\n notification at the time of access to formal instruction. Federal regulations3\n require Federal agencies to provide mandatory training as set forth in\n NIST\xe2\x80\x99s guidance.4 Further, OCIO5 established guidance that requires all\n Department agencies and staff offices to develop, organize, implement, and\n maintain an IT system\xe2\x80\x99s security awareness training program to ensure the\n security of Department information and IT resources. The guidance also\n requires Department and staff offices to conduct this formal training at least\n annually.\n\n To determine if agency personnel had received both kinds of required\n training, we took a judgmental sample of the 12 ERS employee personnel\n files with significant administrative responsibilities over the agency\xe2\x80\x99s\n\n3\n Title 5, Code of Federal Regulations, section 903.301, revised January 1, 2001.\n4\n NIST SP 800-16, Information Technology Security Training Requirements: A Role- and Performance-Based Model, dated April 1998.\n5\n OCIO CS-015, Cyber Security Guidance on Computer Security Awareness Training Programs, dated April 3, 2002.\n\n\nUSDA/OIG-A/14099-1-Te Page 4\n\x0c IT resources. We found that none of the 12 files contained evidence to\n document that computer security awareness training had occurred. While\n 6 of the 12 employees had not received any kind of training, the other 6 had\n received some specialized training. However, ERS last provided specialized\n training to those employees in 1997.\n\n We were told that ERS provides security awareness information to its\n employees through security brochures, presentations, the Intranet, and mass\n e-mails. In regard to specialized training, ERS provides job-specific training\n to its employees when new projects are being implemented and occasionally\n when employees request training. However, ERS should implement a\n formal training program to ensure that all employees who use computer\n systems receive mandatory annual security awareness training and\n employees who manage computer systems receive appropriate training in\n how to fulfill their responsibilities.\n\n Screening Individuals\n\n Although the ERS security plan mentioned employee screening, it did not\n provide any specific guidelines for determining whether a particular\n individual was suitable for a given position.\n\n OMB Circular A-1302 requires that agency security plans establish\n personnel controls for screening individuals who are authorized to bypass\n significant technical and operational security features of computer systems,\n commensurate with the risk and magnitude of harm they could cause. Such\n screening must occur prior to authorizing an individual to bypass controls,\n and periodically thereafter. According to NIST guidance,6 background\n screening helps determine whether an individual is suitable for a given\n position and that, particularly within the Government, periodic rescreening\n of personnel can identify signs of possible illegal activity. Federal\n regulations7 state individuals receiving an appointment made subject to an\n investigation must undergo a background investigation initiated before\n appointment or at most within 14 calendar days of placement in the position.\n Further, agencies may require employees to undergo periodic\n reinvestigations.\n\n To assess whether ERS was requiring employee background screening, we\n took a judgmental sample of the same 12 ERS employee personnel files\n reviewed for training. Six of those files belonged to employees hired within\n the last 3 to 4 years. Of the six new hires, two had a security clearance\n requested by ERS, two received security clearances while employed by\n another agency, and two were student interns that did not receive security\n checks. Additionally, 8 of the 12 employees were authorized to bypass\n\n6\n NIST SP 800-12, An Introduction to Computer Security: The NIST Handbook, dated October 1995.\n7\n Title 5, Code of Federal Regulations, section 731.106, revised as of January 1, 2003.\n\n\nUSDA/OIG-A/14099-1-Te Page 5\n\x0c security controls, but 5 of the 8 employees had undergone security clearance\n investigations between 9 and 30 years ago.\n\n We were told that, although background screening was not regularly\n performed until a few years ago, ERS had started an informal process to\n conduct background screening for all new hires. ERS\xe2\x80\x99 human resources\n staff was also verifying that employees hired within the last 3 to 4 years had\n background checks, but that effort did not include employees hired prior to\n the past 4 years. Without proper background checks on its trusted users,\n ERS does not have assurance that those users can be entrusted with network\n resources and data under its control.\n\n Incident Handling\n\n The ERS security plan addressed incident handling, but ERS had not\n established a formal incident response policy to ensure that events were\n documented and shared with OCIO.\n\n OMB Circular A-1302 requires that agency security plans include an incident\n response policy to ensure that system users receive help when a security\n incident occurs and that information concerning common vulnerabilities and\n threats is shared with other organizations. NIST guidance8 states, when\n faced with an incident, an organization should be able to respond quickly in\n a manner that both protects its own information and helps to protect the\n information of others that might be affected by the incident. Further,\n NIST guidance9 states firewall administrators should examine the logs daily.\n Departmental guidance10 states all USDA agencies and staff offices shall\n establish and implement an internal incident response capability. Further,\n each agency will develop internal reporting procedures that define the\n actions that must be taken in responding to and reporting security incidents.\n At a minimum, internal procedures will include the agency reporting chain\n and require the involvement of the agency personnel and Departmental\n Information Systems Security Program Manager (ISSPM).\n\n We learned that all ERS employees are provided with a brochure that\n describes the agency\xe2\x80\x99s incident response policy. According to the brochure,\n ERS uses a team concept in handling security incidents \xe2\x80\x94 that is, each team\n decides what constitutes an incident and how to handle it. However,\n ERS had not issued specific written instructions to teams for handling and\n reporting security incidents.\n\n\n\n\n8\n NIST SP 800-18, Guide for Developing Security Plans for Information Technology Systems, dated December 1998.\n9\n NIST SP 800-41, Guidelines on Firewalls and Firewall Policy, dated January 2002.\n10\n DM 3500-001, USDA Computer Incident Response Procedures, dated October 25, 2001.\n\n\nUSDA/OIG-A/14099-1-Te Page 6\n\x0c ERS also had not documented several recent security incidents. Apart from\n receiving notification from OCIO of an attempted outside breach against its\n firewall, ERS had never experienced a major security incident according to\n ERS\xe2\x80\x99 ISSPM. However, OCIO had notified ERS of three minor security\n incidents within the last year, and ERS\xe2\x80\x99 ISSPM reviewed the incidents and\n took corrective action as deemed necessary. Those incidents included an\n attempted buffer overflow, in which an intruder tried to gain control of an\n ERS computer system by loading more data into a temporary storage unit\n than it was intended to hold, and Internet Protocol addresses attempting to\n penetrate the system. When we tried to validate how many security\n incidents were reported by OCIO, ERS\xe2\x80\x99 ISSPM could not supply any\n documentation on the incidents and did not know how many incidents had\n been reported.\n\n Additionally, the ISSPM is responsible for reviewing the agency\xe2\x80\x99s firewall\n logs on a daily basis to monitor security incidents and sending the review\n results to OCIO at least 3 times a week. However, we learned that these\n reviews are not conducted if the ISSPM is not at work. The ISSPM will also\n scan from outside the firewall using a commercially available software\n product once a month and send the scan results to OCIO.\n\n We concluded that, without a formal written incident response policy to\n ensure that incidents are documented and shared with OCIO, ERS may not\n be ready to protect its IT resources and assist in the protection of other\n Federal computer systems in the event of a major security incident.\n\n Contingency Planning\n\n Our review further disclosed that ERS\xe2\x80\x99 contingency plan, intended to ensure\n adequate recovery of computer resources in the event of a disaster or other\n major disruption in service, was incomplete and not properly applied.\n\n OMB Circular A-1302 requires that agency security plans establish controls\n to create and periodically test the agency\xe2\x80\x99s ability to continue providing\n service within a system based on the needs and priorities of system users.\n According to NIST,6 contingency plans should be developed for restoring\n critical applications, including arrangements for alternate processing\n facilities in case the usual facilities are significantly damaged or cannot be\n accessed. The plans should also include (1) an assessment of critical data\n and operations to determine the importance and sensitivity of data and other\n organizational assets, (2) an identification of minimum computer resources\n needed to support critical operations, such as computer hardware, software,\n and data files, (3) a policy on data and software backup procedures, and\n (4) guidelines for mandatory training on employee responsibilities in\n preventing, mitigating, and responding to emergency situations.\n\n\nUSDA/OIG-A/14099-1-Te Page 7\n\x0c Additionally, contingency plans should be kept up to date, approved by\n senior management, and tested periodically to discover inevitable flaws.\n\n First, we found that ERS had not identified and prioritized all of its critical\n resources. For example, the agency\xe2\x80\x99s security plan described the sensitivity\n of information handled on system A, but it did not rate or describe the data\n maintained on system B, which also contained confidential information.\n However, ERS\xe2\x80\x99 security plan did describe the computer hardware and\n software used on the LAN to support these IT resources.\n\n Further, we found that ERS\xe2\x80\x99 contingency plan had not been updated,\n approved by senior management, or tested. ERS\xe2\x80\x99 ISSPM stated that the\n contingency plan could not be tested until the agency secured and approved\n a backup site for continuity support.\n\n In addition to flaws with the contingency plan itself, our assessment\n disclosed that ERS had not implemented appropriate data and program\n backup procedures. Specifically, we found that ERS was not keeping its\n wide area network (WAN) backup diskettes offsite. The ISSPM assumed\n the backup diskettes were kept offsite. This assumption was corroborated by\n an ERS WAN team member who stated that he took the backup diskettes\n home in case a disaster prevented access to the bank vault across the street.\n However, we found 12 weekly backup diskettes stored onsite in a fireproof\n safe. We also validated that the team member did not take LAN backup\n tapes home but only took a backup copy of the WAN software settings\n home. After further discussion of the importance of storing backup data\n offsite, ERS representatives agreed to keep the backup diskettes in an offsite\n bank vault.\n\n ERS also had not implemented adequate continuity controls over its physical\n environment. Although the agency had a sophisticated electronic fire\n protection system, including sprinkler heads, smoke detectors, heat\n detectors, manual pull stations, security door override, remote monitor\n alarm, tamper detection systems, and a building-wide alarm system,\n ERS had inadequate controls in place to fully recover in the event of natural\n disasters, such as floods or earthquakes. We noticed that water could leak\n into or flood the LAN room because it contained a wet-pipe sprinkler\n system. An ERS representative stated the LAN room has a water detector\n that will sound an alert for leaks or floods. We requested, but ERS did not\n provide, a floor plan showing the location of the water detectors.\n\n We concluded that ERS had not fulfilled all contingency planning\n requirements or taken steps to minimize and prevent potential damage and\n interruption of its system by implementing adequate backup procedures and\n environmental controls.\n\n\n\nUSDA/OIG-A/14099-1-Te Page 8\n\x0cRecommendation No. 1\n\n Establish and implement controls to periodically assess the IT security\n program to ensure that security planning meets USDA, OMB, NIST, and\n other Federal requirements.\n\n Agency Response. ERS concurs with this recommendation. ERS will\n create a formal process to assess the IT security program through an annual\n review of the current security plan before it is submitted to OCIO, USDA.\n ERS plans to apply this review process to the 2004 submission of the\n security plan. This review will be performed by agency Data Coordinators\n and the Chief Information Officer.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with a copy of the documentation\n detailing the formal process created for assessing the IT security program.\n\nRecommendation No. 2\n\n Establish and implement a formal training program, to include controls to\n ensure that all employees who use computer systems receive mandatory\n annual security awareness training and employees who manage computer\n systems receive appropriate training in how to fulfill their responsibilities.\n\n Agency Response. ERS concurs with this recommendation. USDA\xe2\x80\x99s\n OCIO has implemented an e-Government system that provides all\n USDA employees with a number of basic training classes through the\n Government-wide GoLearn program. ERS has begun to use this resource, as\n directed by OCIO, to provide each employee with security training classes.\n To improve tracking of employee training, USDA is in the process of\n integrating a Learning Management System into the GoLearn system. The\n Learning Management System will be operational in 2004 and integrated\n into human resource systems to improve management of training.\n ERS plans to utilize this system to track and document employee\n participation and completion of training classes.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with documentation supporting\n ERS\xe2\x80\x99 utilization of the Learning Management System for tracking and\n documenting employee training.\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page 9\n\x0cRecommendation No. 3\n\n Establish a formal screening policy to include controls to ensure that\n individuals with significant security responsibilities are screened prior to\n appointment or within 14 calendar days of placement in the position and\n periodically rescreened.\n\n Agency Response. ERS concurs with the recommendation. In\n January 2003, ERS identified positions with significant security\n responsibilities and submitted applications for security clearances for all\n ISD personnel with major security responsibilities. Many of these\n applications are still pending for final approval. Additionally, position\n descriptions for the covered positions have been revised to include the\n requirement for security clearances, the level of clearance required, and the\n reauthorization timeframe.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with a copy of its formal screening policy\n outlining the controls to ensure employees with significant security\n responsibilities are screened prior to appointment and periodically. In\n addition, ERS needs to provide OCFO/PAD with a copy of the revised\n position descriptions.\n\nRecommendation No. 4\n\n Establish a formal written incident response policy to include controls to\n ensure that all security incidents are documented and shared with OCIO.\n\n Agency Response. ERS concurs with this recommendation. By\n October 1, 2004, ERS will create a policy for the review and documentation\n of all security incidents. The log will record the incident and the date it is\n forwarded to OCIO. ERS will only document significant incidents that are\n unique or cause a serious threat to security.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with a copy of its formal incident\n response policy outlining the controls to ensure that all security incidents are\n documented and shared with OCIO.\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page 10\n\x0cRecommendation No. 5\n\n Establish and implement procedures, to include control measures, that\n govern the preparation of a contingency plan to (1) identify and prioritize\n critical operations and the resources supporting them, (2) contain backup\n procedures and environmental controls, and (3) develop emergency priorities\n to support the continuity of these operations. The contingency plan should\n also be approved by senior management and tested annually.\n\n Agency Response. ERS concurs with the recommendation. By\n October 2004, ERS will review its existing Continuity of Operation Plan to\n identify additional needs for contingency planning. ERS will modify the\n Continuity of Operation Plan to include contingency plans for identifying\n critical operations and necessary resources and current LAN backup\n procedures for logging the movement of tapes from the central backup\n system to offsite location. ERS also is making progress in preparing a\n disaster recovery plan for critical systems by installing and testing recovery\n systems onsite and at a remote location. ERS plans on conducting disaster\n recovery tests twice each year and performing ongoing operations to keep\n systems current.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with a copy of the revised Continuity of\n Operation Plan and disaster recovery plan that has been tested and approved\n by senior management.\n\n\n\n\nFinding 2 ERS Needs a Formal Program to Periodically Review Security\n Controls\n\n ERS had no formal program for periodically evaluating its security policies\n and conducting risk assessments to determine the extent of potential threats\n and risks associated with its IT resources. Management had not established\n controls to evaluate the security program for compliance with Federal\n information resource policies and failed to hire skilled personnel to conduct\n risk assessments. Therefore, the agency had no assurance that its current\n IT security measures were adequate to protect its computer system and the\n information it processes.\n\n OMB Circular A-1302 requires agencies to conduct annual security reviews\n and perform a risk analysis at each ADP site every 3 years, or when systems\n undergo significant modification. In addition to OMB requirements,\n\n\n\nUSDA/OIG-A/14099-1-Te Page 11\n\x0c Departmental guidance11 requires agencies to perform formal risk analyses.\n Further, Presidential Decision Directive 63 requires agencies to assess the\n risks to their networks and establish a plan to mitigate the identified risks.\n\n In addition, NIST guidance8 states that, because the security of a system may\n degrade as technology evolves or people and procedures change, periodic\n reviews provide assurance that security controls are functioning effectively\n and providing adequate levels of protection. Further, technical tools such as\n virus scanners, vulnerability assessment products (which look for known\n security problems, configuration errors, and the installation of the latest\n hardware/software patches), and penetration testing can assist in the ongoing\n review of system security measures. These tools, however, are no substitute\n for a formal management review at least every 3 years. OCIO guidance12\n mandates requirements for regular risk assessments using checklists\n designed to determine vulnerabilities on most common IT platforms and\n environments.\n\n ERS senior management has ultimate responsibility for security of the\n agency\xe2\x80\x99s computer systems. However, ERS\xe2\x80\x99 ISD Branch Chief stated that\n the agency had no official program for reviewing security policies and that\n no other audits or security reviews had occurred. He also stated that\n ERS had not budgeted for hiring a skilled person solely to conduct risk\n assessments. By implementing formal procedures for periodic reviews and\n conducting risk assessments, ERS would be able to determine if appropriate\n security measures have been implemented and if the level of risk associated\n with its IT resources is acceptable.\n\n Additionally, since it had not evaluated its security policies or conducted a\n risk assessment, ERS could not officially authorize its systems for operations\n and processing. We noted that the agency had not formally authorized its\n general support and application systems. NIST guidance8 states that a\n management official must authorize a system to operate and process\n information based on an assessment of management, operational, and\n technical controls.\n\nRecommendation No. 6\n\n Establish and implement formal procedures for annual periodic reviews of\n management, technical, and operational controls, and conduct risk\n assessments every 3 years or when systems undergo significant\n modification.\n\n\n\n\n11\n Departmental Manual 3140-1.1, Management of ADP Security Manual, dated July 19, 1984.\n12\n OCIO CS-016, Cyber Security Guidance Regarding Risk Assessments and Security Checklists, dated July 19, 2002.\n\n\nUSDA/OIG-A/14099-1-Te Page 12\n\x0c Agency Response. ERS concurs with the recommendation. ERS will\n conduct its first annual review of management, technical, and operational\n controls of its security systems in May 2004 during the security plan review\n process. It will include the necessary procedures for establishing and\n reviewing risks. ERS also has completed a preliminary risk assessment of\n its WAN/LAN systems. A risk evaluation of the WAN/LAN systems, which\n are the foundations of all systems and applications, will serve as an essential\n part of any other critical system evaluations.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with a copy of its formal procedures for\n annual periodic reviews of IT security controls and for conducting risk\n assessments.\n\nRecommendation No. 7\n\n Establish and implement a process for managers to formally authorize the\n adequacy of existing security for the computer systems they operate or\n applications they develop. Computer systems and applications should be\n reauthorized every 3 years or when systems undergo significant\n modification.\n\n Agency Response. ERS concurs with this recommendation. ERS will\n create a process for managers to formally authorize the security of systems\n or applications that are under their responsibility. The review will be part of\n the preparation and review of the annual security plan. The policy describing\n the process will be completed by the end of 2004.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with documentation detailing the process\n for managers to formally authorize the adequacy of existing security.\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page 13\n\x0cSection 2. Network Security\n\n Coupled with a strong security plan and management oversight, proper use\n of technical tools and resources can contribute to the overall security of an\n agency\xe2\x80\x99s ISSP. To evaluate ERS\xe2\x80\x99 systems, we used three commercially\n available software products that (1) tested for over 1,100 known\n vulnerabilities associated with various operating systems that use\n Transmission Control Protocol/Internet Protocol,13 (2) tested system policy\n settings in network operating systems, and (3) searched for modems within a\n set of telephone numbers to identify potentially unsecured carrier lines.\n\n\n\nFinding 3 Vulnerabilities Expose ERS Systems to the Risk of Attacks\n\n Our vulnerability scans of selected ERS systems disclosed risk indicators\n that could be exploited. We also found that system policy settings did not\n provide for optimum security and were not uniform throughout the agency.\n Many of these vulnerabilities occurred because ERS had not developed a\n configuration management program to ensure routine maintenance of all\n systems with recent security patches and other software updates. As a result,\n ERS systems and networks were vulnerable to cyber attacks. We consider\n the number of vulnerabilities identified to be a material internal control\n weakness that requires additional management oversight.\n\n OMB Circular A-1302 requires agencies to assess the vulnerability of\n information system assets, identify threats, quantify the potential losses from\n threat realization, and develop countermeasures to eliminate or reduce\n threats and potential losses.\n\n Transmission Control Protocol/Internet Protocol System Vulnerabilities\n\n Our vulnerability assessments of 103 network components disclosed\n 203 high-risk, 636 medium-risk, and 1,456 low-risk vulnerabilities. The\n high- and medium-risk vulnerabilities, if left uncorrected, could allow\n unauthorized users to access critical and sensitive ERS data. Additionally,\n the large number of low-risk vulnerabilities we identified can be an\n indication that ERS needs to strengthen its system administration.\n\n\n\n\n13\n Transmission Control Protocol/Internet Protocol is a series of protocols originally developed for use by the U.S. military and now used on the Internet as\nthe primary standard for the movement of data on multiple, diverse platforms.\n\n\nUSDA/OIG-A/14099-1-Te Page 14\n\x0c Detailed below are examples of the high-risk vulnerabilities we identified.\n\n \xe2\x80\xa2 Of the 203 high-risk vulnerabilities, 79 related to inadequate or\n nonexistent passwords. For example, seven accounts were set to\n allow access using a password that was the same as the administrator\n user name. As the most trusted user on a system, the administrator\n has complete control over the system and can perform any function.\n Additionally, we detected 25 accounts with a blank password or no\n required password. Depending on the accounts\xe2\x80\x99 access privileges, an\n attacker could use them to access other computers on the network,\n including the data stored in those computers.\n\n \xe2\x80\xa2 Three hosts had accessible default accounts that could be detected\n through a remote administration program. When software\n applications used to manage computer networks are left configured\n with their original default settings, which are well known, intruders\n are able to easily obtain or change system data and to gain\n information about open connections with other systems. Under an\n effective security policy, these accounts would be removed, renamed,\n or, at minimum, have a difficult-to-guess password.\n\n ERS officials stated that they scanned selected network servers on a monthly\n basis using a scanning tool similar to ours. However, we discovered that the\n agency was not using all of the scanning software\xe2\x80\x99s functions. Depending\n on the purpose of the scan, users of the software can select various scanning\n policies to perform a range of tasks. Instead of using policies to detect\n systems that were improperly configured or compromised by highly skilled\n attackers, ERS used only the scan policy that identifies services running on\n the machines connected to its network. While this policy did identify some\n vulnerabilities, other significant risk indicators went undetected.\n\n We also determined that ERS was not aggressively following up to eliminate\n security vulnerabilities that had already been discovered on its systems. We\n compared the results of scans conducted by ERS to the scans we performed.\n On one system, we found that a high-risk vulnerability identified by ERS in\n February 2002 still existed on that host 10 months later. Additionally, when\n we followed up with ERS 3 months after conducting our scans in\n December 2002, the agency had not begun mitigating the weaknesses we\n identified because the ISSPM was busy with other priorities.\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page 15\n\x0c Network Operating System Policies\n\n Our detailed assessment of security over the ERS network operating system\n identified many access control weaknesses. To make our assessment, we\n used software that produced reports of access control lists, user account\n characteristics, password controls, and many other security features.\n\n Some of the weaknesses we identified in this area are detailed below.\n\n \xe2\x80\xa2 Of the accounts, 73 had passwords that never expired. According to\n NIST guidance,14 passwords should be changed periodically.\n Similarly, OCIO guidance15 requires passwords for all systems,\n applications, and processes to be changed every 60 days for general\n users. Passwords issued to system administrators, system managers,\n and software engineers or those used for dial-in access are to be\n changed every 30 to 45 days.\n\n \xe2\x80\xa2 All 11 administrator-equivalent accounts had passwords that never\n expired, and the passwords for only 2 of those accounts had been\n changed within the last 30 to 45 days. Further, 1 of the 11 accounts\n had not been logged on in over a year.\n\n \xe2\x80\xa2 Of the 25 users, 7 with remote access settings enabled had passwords\n that never expired, and those passwords had not been changed within\n the last 30 to 45 days.\n\n \xe2\x80\xa2 Of the 595 user accounts on the system, 58 users had not logged in\n within the last 90 days. Of these 58 accounts, 26 included the word\n \xe2\x80\x9cDelete\xe2\x80\x9d in the full-name identifier, but the account remained on the\n system. Further, 19 of the 58 accounts were enabled, even though\n 8 of them had not logged into the system in over a year.\n\n \xe2\x80\xa2 Of the accounts that existed on the ERS LAN, 39 were shared or\n generic user accounts. Of the 39 accounts, 7 were still active even\n though they had not logged into the system within the last 90 days.\n Furthermore, NIST guidance6 states that these kinds of accounts\n make it impossible for system administrators to track the actions of\n users in the event that inappropriate or malicious activity occurs.\n Likewise, OCIO guidance15 prohibits shared accounts by requiring\n that each access, whether a user ID or process, be traceable to an\n individual.\n\n\n\n14\n NIST SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, dated September 1996.\n15\n OCIO CS-013, Cyber Security Guidance Regarding Controlled Access Protection, dated March 6, 2002.\n\n\nUSDA/OIG-A/14099-1-Te Page 16\n\x0c We immediately communicated the results of our review of the network\n operating system to ERS management. Based on our findings, ERS took\n action to correct the weaknesses we identified. Specifically, ERS changed\n all nonexpiring passwords to expire every 35 days, eliminated dial-up access\n for the 25 users identified in our review, deleted 35 unused accounts, and\n disabled another 5 unused accounts from the ERS network.\n\n Modem Security\n\n ERS lacked a comprehensive modem listing, indicating lack of control over\n network gateways and noncompliance with regulations.\n\n The presence of unauthorized modems attached to network computers can\n undermine a well-thought-out security plan. For example, if a computer\n with an unauthorized modem is connected to an agency\xe2\x80\x99s network, anyone\n with minimal computer skills and malicious intent can use the unsecured\n modem as a back door into the network. Thus, regulations16 require\n agencies to evaluate security measures in place on network gateways.\n Regulations17 also mandate that agencies conduct vulnerability and risk\n assessments of existing gateways at annual intervals.\n\n Although ERS officials recognized that some of the agency\xe2\x80\x99s desktop\n computers had modems that connected to an Internet service provider\n instead of accessing the Internet through the Departmental network, they\n were unable to provide a complete inventory of modems within\n ERS\xe2\x80\x99 network. ERS officials added that they had never scanned their\n system for these modems. We conducted a detailed assessment of over\n 1,000 ERS telephone numbers to identify active modems and areas of\n inadequate security over modems on the network. Our assessment identified\n a total of 38 lines that could potentially have been modems. ERS officials\n noted that these were probably part of their dial-in modem bank but were\n still researching them at the end of our fieldwork. ERS should maintain an\n accurate list of all the modems on its network to ensure that they are\n properly configured and ensure that they are not used inappropriately to\n circumvent firewall and other network security measures it has in place.\n\n Configuration Management\n\n Our scans further revealed that ERS had not developed a configuration\n management program for its systems. Significant variations appeared in the\n high-risk vulnerabilities we identified, indicating that security patches were\n\n\n\n16\n DR 3140-001, USDA Information Systems Security Policy, dated May 15, 1996.\n17\n DR 3140-002, USDA Internet Security Policy, dated March 7, 1995.\n\n\nUSDA/OIG-A/14099-1-Te Page 17\n\x0c not consistently applied.18 Likewise, 100 of the 203 high-risk vulnerabilities\n we identified existed because the agency had not applied security patches\n and other software updates to its systems in a timely manner. Patches for\n 36 of the 100 vulnerabilities had been available for over a year.\n\n Today more than ever, timely response to vulnerabilities is critical to\n maintain the operational availability, confidentiality, and integrity of\n IT systems. A configuration management program ensures that all systems\n are routinely maintained with recent security patches and other software\n updates. We concluded that a system configuration management program,\n including regularly scheduled and properly conducted vulnerability\n assessments and timely remediation of the risks discovered, would\n substantially enhance the security of ERS\xe2\x80\x99 network operating systems.\n\n Firewall Configuration\n\n Finally, we reviewed ERS\xe2\x80\x99 firewall configuration to determine if it was\n adequately protecting the network. Overall, we found that ERS had\n maintained its firewall adequately. However, we found several firewall rules\n that were either no longer needed or were not configured in the best interest\n of ERS network security. ERS had not established controls to conduct\n routine and timely reviews of firewall configuration. Therefore,\n ERS\xe2\x80\x99 network was exposed to risk of attack from Internet users.\n\n NIST guidance19 states firewall and security policies should be audited and\n verified at least quarterly. At a minimum, firewall policy can be verified by\n obtaining hardcopies of the firewall configurations and comparing these\n hardcopies against the expected configuration based on defined policy.\n\n ERS officials took immediate action on most of our concerns by either\n deleting or modifying firewall rules to improve security. However, the\n network officials accepted the risks posed by two of our concerns.\n Additionally, ERS officials informed us that they routinely reviewed the\n access logs generated by the firewall, but they only infrequently reviewed\n the firewall rules that protect the network.\n\n\n\n\n18\n According to NIST guidance, security-related programming flaws are generally discovered only after a large number of users start using the software\nand hackers and independent testers start attempting to compromise it. Once a programming flaw is discovered, the software manufacturer often releases a\npiece of software to correct the flaw. This software is often called a patch, hot fix, or service pack.\n19\n NIST SP 800-41, Guidelines on Firewalls and Firewall Policy, dated January 2002.\n\n\nUSDA/OIG-A/14099-1-Te Page 18\n\x0cRecommendation No. 8\n\n Ensure that corrective actions have been taken on all high- and medium-risk\n vulnerabilities identified during our audit, track the vulnerabilities, and\n certify that actions have been taken to remedy these vulnerabilities.\n\n Agency Response. ERS concurs with this recommendation. By\n June 2004, ERS will have completed the procedures to identify and track\n all security vulnerabilities of its systems. OIG Recommendations\n Nos. 9 through 13 provide more specific coverage of actions to be taken in\n this regard. Under these specific recommendations, ERS will take corrective\n actions as it judges necessary. Some vulnerabilities identified in the audit\n cannot be corrected due to changes in IP address assignments. If a particular\n vulnerability cannot be traced to a specific workstation or device, the agency\n will not be able to make a correction. As with other issues, the agency will\n evaluate the risk associated with a particular vulnerability and will take\n appropriate actions based on the findings.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with documentation certifying that\n appropriate corrective actions have been taken to remedy these\n vulnerabilities.\n\nRecommendation No. 9\n\n Establish and implement a policy to use the proper scanning policy to detect\n all network vulnerabilities and ensure that prompt action is taken to\n eliminate noted vulnerabilities.\n\n Agency Response. ERS concurs with the recommendation. ERS has\n created a scanning policy that will be implemented in March 2004. The\n policy specifies the types of scans to be conducted; scans will be conducted\n monthly and activities to correct vulnerabilities will be tracked in a log.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with a copy of its scanning policy for\n detecting and eliminating all network vulnerabilities.\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page 19\n\x0cRecommendation No. 10\n\n Establish and implement a policy outlining minimum computer access\n security settings to include controls to ensure that settings have not been\n misapplied.\n\n Agency Response. ERS concurs with this recommendation. There are\n various policies in place, but they are not comprehensive. ERS will\n document existing policies for access security settings and will create a\n process to review compliance with these policies. The process will provide\n for timely review and correction of deficiencies and will be in place by the\n end of 2004.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with documentation of computer access\n security setting policies and process for timely reviewing compliance with\n these policies.\n\nRecommendation No. 11\n\n Establish and implement a configuration management program to include\n controls to ensure that the program is functioning as planned.\n\n Agency Response. ERS concurs with this recommendation. ERS has\n implemented a configuration management program that includes controls to\n ensure that the program is functioning as planned. ERS participates in the\n USDA program to license a system that provides centralized configuration\n management and reporting. ERS has been utilizing the system to keep all\n operating systems patched to avoid critical security vulnerabilities since\n December 2003.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with documentation identifying the\n configuration management program, including controls to ensure that the\n program is functioning as planned.\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page 20\n\x0cRecommendation No. 12\n\n Establish and implement a remote access policy to include controls to\n establish an accurate list of all modems on its network, ensure that they are\n properly configured, make sure that they are not used inappropriately to\n circumvent firewall and other network security measures it has in place, and\n update the listing on a periodic basis.\n\n Agency Response. ERS concurs with this recommendation. By\n June 1, 2004, ERS plans to complete the inventory of all modems on its\n network and will develop a policy to specify how and when modems are\n authorized for connection to the network. There will be an annual review of\n the configuration and usage of the modems. ERS has been incrementally\n eliminating the use of modems from its network and will continue with this\n effort.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with a copy of its remote access policy,\n including controls to ensure that modems are not used inappropriately to\n bypass network security.\n\nRecommendation No. 13\n\n Establish and implement a policy to include controls to conduct routine and\n timely reviews of firewall configuration.\n\n Agency Response. ERS concurs with this recommendation. ERS has\n created a policy for quarterly reviews of the firewall configuration. The\n review will focus on the adequacy of rules incorporated into the\n configuration and the elimination of unnecessary rules. The first review was\n completed during February 2004. The policy includes documenting all of\n the existing rules and any actions taken during the review.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with a copy of its firewall review policy,\n including controls to ensure that firewall rules are adequate and documented.\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page 21\n\x0cSection 3. Access Controls\n\n We assessed ERS\xe2\x80\x99 logical and physical access controls to determine if they\n adequately detected and prevented unauthorized entry to agency automated\n information and computer systems. We found a significant number of\n logical control weaknesses in the systems we tested, as well as problems\n related to physical access.\n\n OMB Circular A-1302 stresses management controls affecting IT users.\n These controls help to protect operating systems and other software from\n unauthorized modification and to protect the integrity, availability, and\n confidentiality of information by restricting the number of users, and provide\n protection from disclosure of information to unauthorized individuals.\n NIST guidance6 defines access controls as physical controls, such as keeping\n computers in locked rooms to limit physical access, and logical controls,\n such as security software programs designed to prevent or detect\n unauthorized access to sensitive files.\n\n\n\nFinding 4 ERS Needs to Strengthen Its Access Controls\n\n Although ERS had established procedures for requesting computer access\n and reviewed user access lists, the agency had not reviewed its computer\n access procedures to determine if they were adequate. ERS also had not\n conducted a security assessment of logical and physical access controls to\n determine if they met departmental guidelines. ERS had not established\n controls to ensure compliance with Federal information resource policies\n and failed to hire skilled personnel to conduct risk assessment. Therefore,\n ERS had no assurance that its computer resources are protected against\n unauthorized access.\n\n OMB Circular A-1302 and Departmental guidance11 contain standards,\n guidelines, and procedures for the development and administration of\n agencies\xe2\x80\x99 automated information security programs. Agencies are required\n to establish controls to assure adequate security for all information they\n process, transmit, or store. Further, agencies must review the security\n controls in each system at least every 3 years, or when significant\n modifications are made to the system; the scope and frequency of these\n reviews must be commensurate with the acceptable level of risk for the\n system. NIST guidance8 advises that periodic reviews provide assurance\n that controls are functioning effectively and providing adequate levels of\n protection. Further, NIST guidance14 states organizations should base access\n control policies on the principle of least privilege, which states that users\n should be granted access only to the resources they need to perform their\n\n\n\nUSDA/OIG-A/14099-1-Te Page 22\n\x0c official functions, and organizations should carefully administer access\n controls.\n\n Logical Access\n\n We found a significant number of material logical access control weaknesses\n in the ERS systems we tested. We also found that ERS had not conducted\n periodic reviews to determine if its logical access controls were adequate to\n protect sensitive data. ERS\xe2\x80\x99 ISD Branch Chief stated that there had been no\n other audits or security reviews at ERS, and that the agency had no official\n program for reviewing security policies.\n\n Our review disclosed that ERS\xe2\x80\x99 lists of users authorized to access the LAN,\n the National Finance Center, and the National Information Technology\n Center are not being regularly reviewed and had not been updated to reflect\n current users. Specifically, we found that ERS\xe2\x80\x99 computer access lists\n contained enabled user IDs for separated personnel, disabled user IDs,\n duplicate IDs, user names that had not been changed, and inaccurate and\n incomplete information maintained for non-Federal employees.\n\n Departmental guidance20 requires security staff to remove employee user\n IDs and passwords when the employee is no longer with the agency. A\n formal procedure should be established for notification of the security\n officers by the agency personnel office of all retirements or other personnel\n separations. When there is a change of a contractor that uses the system, all\n user IDs and passwords on the system must be changed as soon as the\n contractor\xe2\x80\x99s services are terminated. Security staff must maintain files of\n users, including names, office addresses, and telephone numbers.\n\n ERS\xe2\x80\x99 representative for ISD explained that it was difficult to maintain\n computer access lists since ISD was not always informed and did not always\n receive the separating employee\xe2\x80\x99s checklist. ERS\xe2\x80\x99 procedure for separating\n employees instructs supervisors to circulate a separating employee\xe2\x80\x99s\n checklist to ISD for removal of the employee\xe2\x80\x99s access to agency computer\n systems. Furthermore, ISD also did not receive the list of current and\n separated contractors and non-Federal employees. ERS should strengthen its\n internal controls to ensure that all computer access lists are updated and\n routed to ISD, and ISD is notified and receives the separating employees\xe2\x80\x99\n checklists when employees terminate their employment.\n\n We also reviewed ERS user profiles and identified 65 users that had shared\n or generic accounts. Of these accounts, 4 permitted users to access sensitive\n data, and the remaining 61 accounts allowed access only to standard\n software packages. Departmental guidance20 states issuance of group\n user IDs and passwords and the sharing of the same are not permitted.\n\n20\n DM 3140-1.6, Management ADP Security Manual, dated July 19, 1984.\n\n\nUSDA/OIG-A/14099-1-Te Page 23\n\x0c When we inquired into the use of these accounts, ERS staff stated that they\n were needed for a special project related to homeland security.\n ERS LAN staff also stated that they were in the process of reviewing shared\n and generic accounts and disabling or deleting them. We concluded that\n ERS should establish formal access authorization procedures for periodic\n review and maintenance of computer access accounts, including review of\n access logs by management, independent of the security function.\n\n In regard to remote access, our review disclosed that ERS had not reviewed\n its security controls in that area to determine if they were adequate.\n Although ERS justified, documented, and approved requests according to\n NIST guidance,14 it had not periodically reviewed controls over remote\n access. At the time of our review, remote users could access ERS\xe2\x80\x99 network\n through three methods, but only one of those methods was approved by\n ERS for users handling the agency\xe2\x80\x99s sensitive data. Data transmitted\n through the other two methods is either not encrypted or secure and could\n permit unauthorized access. However, we found that some users who\n handled sensitive data could use unapproved methods for remote access. For\n example, some users who are authorized to handle sensitive data on one of\n its systems, such as farm income and social security numbers, also had the\n capability to access this data through unapproved methods. We concluded\n that ERS should periodically review its list of remote access users to ensure\n that it grants them only the appropriate access.\n\n Finally, we reviewed ERS\xe2\x80\x99 network account policy settings and found that\n the parameters established for password uniqueness and logon attempts did\n not meet established guidelines. According to OCIO guidance,15 systems\n shall not allow reuse of a previously used password until after five different\n passwords have been used. Departmental guidelines20 require that access to\n the system be rejected after three bad logon attempts.\n\n Although the LAN staff told us that they met regularly to discuss security\n and had agreed to set password history to 3, and bad logon attempts to 5,\n our review of ERS network account policy settings found the parameter for\n password history set to 3 and bad logon attempts set to 10. The LAN staff\n did not know when the parameter for bad logon attempts was set at 10.\n\n We concluded that ERS should establish guidelines to periodically review its\n network account policy settings, as well as user access and user profiles.\n\n Physical Access\n\n Our assessment of ERS\xe2\x80\x99 physical access controls disclosed improper\n procedures, which posed a threat to security of the LAN room and backup\n tapes.\n\n\n\nUSDA/OIG-A/14099-1-Te Page 24\n\x0c We found that ERS controls access to the LAN room by issuing electronic\n security keys to employees and contractors. OCIO guidance21 states that\n only Department personnel and authorized contractors having an ongoing\n recurring business need will be given unescorted access to the IT restricted\n space. Further, cleaning staff, maintenance personnel, and visitors shall be\n escorted at all times by Department or permanent contractors. ERS provided\n us a list containing the names of individuals who had been issued electronic\n security keys for access to the LAN room and assisted us in reviewing it.\n The list included multiple individuals from the cleaning staff and one other\n employee who should not have had access. We concluded that ERS should\n not issue electronic security keys to cleaning staff, maintenance personnel,\n and visitors for physical access to sensitive areas.\n\n Furthermore, ERS did not maintain logs for documenting visitors to\n sensitive areas or for recording the transfer of LAN backup tapes to and\n from offsite storage. NIST6 and OCIO21 guidance state that logs can include\n the times and dates of transfers, names and signatures of individuals\n involved, and other relevant information. By maintaining physical access\n control logs for sensitive areas and backup tapes, ERS can protect its\n computer resources from unauthorized access and hold authorized\n individuals accountable for their actions.\n\n We tested ERS\xe2\x80\x99 physical access controls by requesting entry to the\n LAN room and by accompanying an ERS employee to deposit LAN backup\n tapes at the offsite storage facility. We did not have to sign a log when we\n toured the LAN room, nor did the ERS employee sign a log to track the\n movement of the LAN backup tapes. We concluded that ERS should escort\n all visitors to the LAN room and other sensitive areas and require visitors to\n sign a log upon entering and exiting the facility.\n\n Logical controls alone cannot protect the integrity and confidentiality of\n sensitive files. For this reason, it is important that ERS establish formal\n procedures to ensure that physical access to the LAN room and backup tapes\n are controlled. ERS should also conduct periodic physical access reviews to\n determine if controls are effective in preventing unauthorized access to\n computer resources.\n\n\n\n\n21\n OCIO CS-05, Cyber Security Guidance on Physical Security in USDA IT Restricted Space, dated November 28, 2001.\n\n\nUSDA/OIG-A/14099-1-Te Page 25\n\x0cRecommendation No. 14\n\n Establish and implement formal procedures and controls for periodic\n reviews of logical and physical access controls to determine if controls are\n up to date and functioning as designed.\n\n Agency Response. ERS concurs with this recommendation. By\n January 1, 2005, ERS will conduct quarterly reviews of its logical and\n physical access controls to include enforcing existing procedures in\n notifying security staff when employees or contractors no longer require\n system access. The procedure will include a review process by the Chief\n Information Officer and agency Data Coordinators to judge the adequacy of\n the process. The review will use the agency\xe2\x80\x99s e-mail address book to\n provide information on current status of employees, their room numbers, and\n phone numbers.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with a copy of its written formal\n procedures developed for the quarterly review process of logical and\n physical access controls.\n\nRecommendation No. 15\n\n Establish and implement internal control procedures to ensure that all\n computer access lists are updated and routed to ISD, and that ISD is notified\n and receives a separating employees\xe2\x80\x99 checklist when employees terminate\n their employment.\n\n Agency Response. ERS concurs with this recommendation. By\n July 1, 2004, ERS will review the existing procedure for clearing employees\n as they depart the agency. The review will add requirements for non-Federal\n employees and contractors. The review will focus on creating assurances\n that policy is being followed and that ISD is receiving proper notification.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with a copy of its written procedures\n including controls to ensure that access lists are updated and routed to ISD,\n and that ISD is notified when employees terminate their employment.\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page 26\n\x0cRecommendation No. 16\n\n Establish and implement formal access authorization procedures to include\n controls for periodic review and maintenance of computer access accounts,\n including review of computer access lists, LAN account policy settings, and\n access logs.\n\n Agency Response. ERS concurs with this recommendation. This is\n similar in nature to Recommendation No. 10. The agency response there\n should cover this recommendation as well.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD with a copy of its written procedure,\n including controls detailing the steps security personnel are to follow in\n authorizing access and in performing periodic reviews of access accounts to\n ensure that access granted to employees is appropriate for their assigned\n duties.\n\nRecommendation No. 17\n\n Establish and implement formal physical access control procedures for\n logging visitor access to the LAN room and tracking the location of backup\n tapes.\n\n Agency Response. ERS concurs with this recommendation. ERS has\n created a logbook to document physical access to the LAN room and has\n created logs to track the location and movement of backup tapes.\n\n OIG Position. We accept the ERS management decision. For final action,\n ERS needs to provide OCFO/PAD a copy of the logbooks created to\n document physical access to the LAN room and to document the movement\n of backup tapes.\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page 27\n\x0cScope and Methodology\n We selected ERS as part of a nationwide review of eight USDA agencies\n with major computer systems. Audit work was performed at the\n ERS National Office located in Washington, D.C. We reviewed controls\n over the agency\xe2\x80\x99s computer systems to ensure the integrity of its information\n security program. Our fieldwork was performed during and for the period\n October 2002 through June 2003.\n\n To accomplish the audit objectives, we performed the following steps.\n\n \xe2\x80\xa2 Tested ERS\xe2\x80\x99 security programs, including both physical and logical\n access controls, by analyzing records and controls established by the\n agency to protect its computer systems.\n\n \xe2\x80\xa2 Reviewed and compared the controls ERS had established to protect its\n IT resources with the requirements of the Computer Security Act of\n 1987, Federal regulations, departmental regulations and manuals, and\n other sources.\n\n \xe2\x80\xa2 Interviewed ERS officials responsible for managing the agency\xe2\x80\x99s\n computer systems.\n\n \xe2\x80\xa2 Referred to Government policies such as Presidential Decision\n Directive 63 and used commercial, off-the-shelf software products to\n scan 103 ERS critical network components for vulnerabilities.\n\n This audit was conducted in accordance with generally accepted Government\n auditing standards. Therefore, the audit included tests of program and\n accounting records considered necessary to meet the audit objectives.\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page 28\n\x0cExhibit A \xe2\x80\x93 Agency Response\n\n\n\n\nUSDA/OIG-A/14099-1-Te Page 29\n\x0cUSDA/OIG-A/14099-1-Te Page 30\n\x0cUSDA/OIG-A/14099-1-Te Page 31\n\x0cUSDA/OIG-A/14099-1-Te Page 32\n\x0cUSDA/OIG-A/14099-1-Te Page 33\n\x0c\x0c'


type: caselaw

jurisdiction: EU

text:
 31.7.2010
 SL
 Uradni list Evropske unije
 C 209/47
 Tožba, vložena 24. maja 2010 – Poljska proti Komisiji
 (Zadeva T-241/10)
 ()
 2010/C 209/71
 Jezik postopka: poljščina
 Stranki
 Tožeča stranka: Republika Poljska (zastopnik: M. Szpunar, zastopnik)
 Tožena stranka: Evropska komisija
 Predloga tožeče stranke
 Tožeča stranka predlaga, naj
 —
 se sklep Komisije z dne 11. marca 2010 [notificiran pod dokumentarno številko C(2010) 1317] o izključitvi nekaterih odhodkov držav članic iz naslova Jamstvenega oddelka Evropskega kmetijskega usmerjevalnega in jamstvenega sklada (EKUJS), Evropskega kmetijskega jamstvenega sklada (EKJS) in Evropskega kmetijskega sklada za razvoj podeželja (EKSRP) iz financiranja Evropske unije (2010/152/EU) (1) razglasi za ničnega v delu, v katerem odhodke pooblaščene plačilne agencije Republike Poljske v višini 279 794 442,15 PLN in 25 583 996,81 EUR izključuje iz financiranja Evropske unije;
 —
 se Komisiji naloži plačilo stroškov.
 Tožbeni razlogi in bistvene trditve
 Izpodbijani sklep določa finančni popravek zaradi pomanjkljivosti v sistemu za identifikacijo in nadzor nad zemljiškimi parcelami v letih 2005 in 2006, in sicer sistem za identifikacijo zemljiških parcel ni bil v celoti vektoriziran, odobrena so bila plačila za zemljišča, za katera to ni bilo upravičeno, opravljeno je bilo premajhno število pregledov na kraju samem v regijah z visokimi stopnjami napak (Województwo opolskie) in določbe o namerni neskladnosti so bile napačno uporabljene.
 Tožeča stranka izpodbija obstoj očitanih pomanjkljivosti in navaja naslednje tožbene razloge zoper izpodbijani sklep.
 Prvič, sklicuje se na kršitev člena 7(4), prvi pododstavek, Uredbe (ES) št. 1258/1999 (2) in člena 31(1) Uredbe št. 1290/2005 (3) ter kršitve v dokumentu VI/5330/97 navedenih smernic, ker naj bi bil finančni popravek izveden na podlagi napačne ugotovitve dejanskega stanja in napačne razlage prava, čeprav so poljski organi odhodke opravili v skladu s predpisi Evropske unije.
 Nobena od pomanjkljivosti, ki so temelj za finančni popravek, naj ne bi bila dejansko storjena, in odhodki, ki so bili z izpodbijano odločbo izključeni iz financiranja Evropske unije, naj bi bili opravljeni v skladu s predpisi Evropske unije.
 Sistem, ki je bil v letih 2005 in 2006 na Poljskem uporabljen za identifikacijo zemljiških parcel, naj bi v celoti in povsem izpolnjeval zahteve iz člena 20 Uredbe (ES) št. 1782/2003 (4) in člena 6 Uredbe (ES) št. 796/2004 (5); v nekaterih vidikih naj bi ta sistem presegal te zahteve in zagotavljal strogo varstvo finančnih interesov Evropske unije.
 Nacionalni postopki, ki so se vodili v letih 2005 in 2006, naj bi omogočali učinkovito in objektivno ugotavljanje, ali je v primeru navedbe prevelike površine zemljišča za plačilo vlagatelj zahtevka ravnal namerno ali ne, s tem, da so bile v spornih primerih predvidene sodne odločbe in upoštevana domneva nedolžnosti.
 Priznanje zemljišč za plačilo naj bi bilo opravljeno v skladu s pogoji za pridobitev pomoči za zemljišča, ker je v skladu s pridružitvenim sporazumom ohranitev zemljišča v dobrih kmetijskih pogojih (DKP) do 30. junija 2003 pogoj za pridobitev pomoči, medtem ko je ohranitev zemljišča v dobrih kmetijskih in okoljskih pogojih (DKOP) na dan pregleda ni pogoj za pridobitev pomoči za to zemljišče, temveč pogoj, ki – če ni izpolnjen – vodi v znižanje zneska plačila.
 Število pregledov na kraju samem v Województwo opolskie v letu 2005 naj bi izpolnjevalo zahteve iz člena 26 Uredbe (ES) št. 796/2004.
 Drugič, tožeča stranka navaja kršitve člena 7(4), pododstavek 4, Uredbe (ES) št. 1258/1999 in člena 31(2) Uredbe (ES) št. 1290/2005, kršitve v dokumentu VI/5330/97 navedenih smernic ter načela sorazmernosti, ker naj bi bil popravek povsem previsok glede na tveganje morebitnih izgub za proračun Evropske unije.
 Tudi če bi obstajale, pa niso, nekatere pomanjkljivosti v sistemu za nadzor in sankcije, ki so ga vzpostavile poljske oblasti, bi bile te pomanjkljivosti tako nepomembne, da bi se tveganje morebitnih izgub za proračun Unije nanašalo na precej nižji znesek, kot je znesek, ki ga je uporabila Komisija za popravek v izpodbijanem sklepu. To velja še posebej za popravek, ki ga je Komisija uporabila, ker naj bi sistem za identifikacijo zemljiških parcel ne bil v celoti vektoriziran in ker naj v letu 2005 ne bi bilo opravljeno zadostno število pregledov na kraju samem v Województwo opolskie.
 (1) UL L 63, str. 7.
 (2) Uredba Sveta (ES) št. 1258/1999 z dne 17. maja 1999 o financiranju skupne kmetijske politike (UL L 160, str. 103).
 (3) Uredba Sveta (ES) št. 1290/2005 z dne 21. junija 2005 o financiranju skupne kmetijske politike (UL L 209, str. 1).
 (4) Uredba Sveta (ES) št. 1782/2003 z dne 29. septembra 2003 o skupnih pravilih za sheme neposrednih podpor v okviru skupne kmetijske politike in o uvedbi nekaterih shem podpor za kmete ter o spremembi uredb (EGS) št. 2019/93, (ES) št. 1452/2001, (ES) št. 1453/2001, (ES) št. 1454/2001, (ES) 1868/94, (ES) št. 1251/1999, (ES) št. 1254/1999, (ES) št. 1673/2000, (EGS) št. 2358/71 in (ES) št. 2529/2001 (UL L 270, str. 1).
 (5) Uredba Komisije (ES) št. 796/2004 z dne 21. aprila 2004 o podrobnih pravilih za izvajanje navzkrižne skladnosti, modulacije in integriranega administrativnega in kontrolnega sistema, predvidenih z Uredbo Sveta (ES) št. 1782/2003 o skupnih pravilih za sheme neposrednih podpor v okviru skupne kmetijske politike ter o uvedbi nekaterih shem podpor za kmete (UL L 141, str. 18).


type: contracts

text:
 22.11.2018
 SV
 Europeiska unionens officiella tidning
 L 297/12
 GEMENSAMMA EES-KOMMITTÉNS BESLUT
 nr 10/2017
 av den 3 februari 2017
 om ändring av bilaga II (Tekniska föreskrifter, standarder, provning och certifiering) till EES-avtalet [2018/1744]
 GEMENSAMMA EES-KOMMITTÉN HAR ANTAGIT DETTA BESLUT
 med beaktande av avtalet om Europeiska ekonomiska samarbetsområdet (nedan kallat EES-avtalet), särskilt artikel 98, och
 av följande skäl:
 (1)
 Kommissionens delegerade förordning (EU) 2016/1788 av den 14 juli 2016 om ändring av Europaparlamentets och rådets förordning (EU) nr 167/2013 vad gäller förteckningen över krav för EU-typgodkännande av fordon och om ändring och rättelse av kommissionens delegerade förordningar (EU) nr 1322/2014, (EU) 2015/96, (EU) 2015/68 och (EU) 2015/208 vad gäller fordonskonstruktion och allmänna krav, krav på miljöprestanda och framdrivningsenheters prestanda, krav på fordonsbromsar och krav på funktionssäkerhet hos fordon (1) bör införlivas med EES-avtalet.
 (2)
 Bilaga II till EES-avtalet bör därför ändras i enlighet med detta.
 HÄRIGENOM FÖRESKRIVS FÖLJANDE.
 Artikel 1
 Kapitel II i bilaga II till EES-avtalet ska ändras på följande sätt:
 1.
 Följande strecksats ska läggas till i punkt 40 (Europaparlamentets och rådets förordning (EU) nr 167/2013):
 ”—
 32016 R 1788: Kommissionens delegerade förordning (EU) 2016/1788 av den 14 juli 2016 (EUT L 277, 13.10.2016, s. 1)”.
 2.
 Följande ska läggas till i punkt 40a (kommissionens delegerade förordning (EU) nr 1322/2014):
 ”, ändrad genom
 —
 32016 R 1788: Kommissionens delegerade förordning (EU) 2016/1788 av den 14 juli 2016 (EUT L 277, 13.10.2016, s. 1)”.
 3.
 Följande ska läggas till i punkt 40b (kommissionens delegerade förordning (EU) 2015/68):
 ”, ändrad genom
 —
 32016 R 1788: Kommissionens delegerade förordning (EU) 2016/1788 av den 14 juli 2016 (EUT L 277, 13.10.2016, s. 1)”.
 4.
 Följande ska läggas till i punkt 40c (kommissionens delegerade förordning (EU) 2015/96):
 ”, ändrad genom
 —
 32016 R 1788: Kommissionens delegerade förordning (EU) 2016/1788 av den 14 juli 2016 (EUT L 277, 13.10.2016, s. 1)”.
 5.
 Följande ska läggas till i punkt 41 (kommissionens delegerade förordning (EU) 2015/208):
 ”, ändrad genom
 —
 32016 R 1788: Kommissionens delegerade förordning (EU) 2016/1788 av den 14 juli 2016 (EUT L 277, 13.10.2016, s. 1)”.
 Artikel 2
 Texten till delegerad förordning (EU) 2016/1788 på isländska och norska, som ska offentliggöras i EES-supplementet till Europeiska unionens officiella tidning, ska vara giltig.
 Artikel 3
 Detta beslut träder i kraft den 4 februari 2017 under förutsättning att alla anmälningar enligt artikel 103.1 i EES-avtalet har gjorts (*1).
 Artikel 4
 Detta beslut ska offentliggöras i EES-delen av och EES-supplementet till Europeiska unionens officiella tidning.
 Utfärdat i Bryssel den 3 februari 2017.
 På gemensamma EES-kommitténs vägnar
 Claude MAERTEN
 Ordförande
 (1) EUT L 277, 13.10.2016, s. 1.
 (*1) Inga konstitutionella krav angivna.


type: legislation

text:
 22.11.2014
 SL
 Uradni list Evropske unije
 L 335/7
 IZVEDBENA UREDBA KOMISIJE (EU) št. 1249/2014
 z dne 21. novembra 2014
 o izdaji dovoljenja za inozitol kot krmni dodatek za ribe in rake
 (Besedilo velja za EGP)
 EVROPSKA KOMISIJA JE –
 ob upoštevanju Pogodbe o delovanju Evropske unije,
 ob upoštevanju Uredbe Evropskega parlamenta in Sveta (ES) št. 1831/2003 z dne 22. septembra 2003 o dodatkih za uporabo v prehrani živali (1) in zlasti člena 9(2) Uredbe,
 ob upoštevanju naslednjega:
 (1)
 Uredba (ES) št. 1831/2003 določa izdajo dovoljenj za dodatke za uporabo v prehrani živali ter razloge in postopke za izdajo takih dovoljenj. Člen 10 navedene uredbe določa ponovno oceno dodatkov, dovoljenih v skladu z Direktivo Sveta 70/524/EGS (2).
 (2)
 V skladu z Direktivo 70/524/EGS je bilo izdano dovoljenje brez časovne omejitve za inozitol kot krmni dodatek za vse živalske vrste v okviru skupine „vitamini, provitamini in kemijsko dobro definirane snovi s podobnim učinkom“. Navedena snov je bila v skladu s členom 10(1) Uredbe (ES) št. 1831/2003 naknadno vpisana v register krmnih dodatkov Skupnosti kot obstoječ proizvod.
 (3)
 V skladu s členom 10(2) Uredbe (ES) št. 1831/2003 in v povezavi s členom 7 navedene uredbe je bil vložen zahtevek za ponovno oceno inozitola kot krmnega dodatka za ribe, rake, mačke in pse. Vložnik je zahteval, da se dodatek uvrsti v kategorijo dodatkov „nutritivni dodatki“. V skladu s členom 7(3) Uredbe (ES) št. 1831/2003 so bili navedenemu zahtevku priloženi zahtevani podatki in dokumenti.
 (4)
 Evropska agencija za varnost hrane („Agencija“) je v mnenju z dne 9. aprila 2014 (3) navedla, da inozitol pod predlaganimi pogoji uporabe nima škodljivega vpliva na zdravje živali in ljudi ali okolje. Agencija je tudi sklenila, da se inozitol šteje kot učinkovit vir esencielnih mikrohranil za ribe in rake. Agencija meni, da ni potrebe po posebnih zahtevah v zvezi s spremljanjem po dajanju na trg. Potrdila je tudi poročilo o analitski metodi krmnega dodatka, ki ga je predložil referenčni laboratorij, ustanovljen z Uredbo (ES) št. 1831/2003.
 (5)
 Ocena inozitola je pokazala, da so pogoji za dovoljenje iz člena 5 Uredbe (ES) št. 1831/2003 izpolnjeni. Zato bi bilo treba dovoliti uporabo navedene snovi, kakor je opredeljeno v Prilogi k tej uredbi.
 (6)
 Ker ni varnostnih razlogov, ki bi zahtevali takojšnjo uporabo sprememb pogojev dovoljenja, je primerno, da se omogoči prehodno obdobje za porabo obstoječih zalog dodatkov ter premiksov in krmnih mešanic, ki ju vsebujejo, kot je dovoljeno z Direktivo 70/524/EGS.
 (7)
 Ukrepi iz te uredbe so v skladu z mnenjem Stalnega odbora za rastline, živali, hrano in krmo –
 SPREJELA NASLEDNJO UREDBO:
 Člen 1
 Snov iz Priloge, ki spada v kategorijo dodatkov „nutritivni dodatki“ in funkcionalno skupino „vitamini, provitamini in kemijsko natančno definirane snovi s podobnimi učinki“, se dovoli kot dodatek v prehrani živali v skladu s pogoji iz navedene priloge.
 Člen 2
 Snov iz Priloge in krma, ki vsebuje navedeno snov, proizvedeni in označeni pred 12. junijem 2015 v skladu s pravili, ki se uporabljajo pred 12. decembrom 2014, se lahko še naprej dajeta na trg in uporabljata do porabe obstoječih zalog.
 Člen 3
 Ta uredba začne veljati dvajseti dan po objavi v Uradnem listu Evropske unije.
 Ta uredba je v celoti zavezujoča in se neposredno uporablja v vseh državah članicah.
 V Bruslju, 21. decembra 2014
 Za Komisijo
 Predsednik
 Jean-Claude JUNCKER
 (1) UL L 268, 18.10.2003, str. 29.
 (2) Direktiva Sveta 70/524/EGS z dne 23. novembra 1970 o dodatkih v krmi (UL L 270, 14.12.1970, str. 1).
 (3) EFSA Journal 2014;12(5):3671.
 PRILOGA
 Identifikacijska številka dodatka
 Dodatek
 Sestava, kemijska formula, opis, analitska metoda
 Vrsta ali kategorija živali
 Najvišja starost
 Najnižja vsebnost
 Najvišja vsebnost
 Druge določbe
 Datum poteka veljavnosti dovoljenja
 mg aktivne snovi/kg popolne krmne mešanice z vsebnostjo vlage 12 %
 Nutritivni dodatki: vitamini, provitamini in kemijsko natančno opredeljene snovi s podobnim učinkom
 3a900
 inozitol
 Sestava dodatka
 Inozitol
 Lastnosti aktivne snovi
 Inozitol
 Kemijska formula: C6H12O6
 Št. CAS: 87-89-8
 Inozitol, v trdni obliki, pridobljen s kemijsko sintezo.
 Merila čistosti: najmanj 97 %.
 Analitska metoda
 (1)
 Za določanje inozitola v krmnem dodatku: tekočinska kromatografija in infrardeča absorpcijska spektrometrija (Ph. Eur. 01/2008:1805).
 Za določanje količine inozitola v krmnem dodatku, premiksih in krmi: analiza mikrobiološke aktivnosti.
 ribe in raki
 —
 —
 —
 1.
 V navodilih za uporabo dodatka in premiksa je treba navesti pogoje skladiščenja in obstojnosti.
 2.
 Zaradi varnosti je treba med ravnanjem nositi zaščito za dihala ter zaščitna očala in rokavice.
 12. december 2014
 (1) Podrobnosti o analitskih metodah so na voljo na naslednjem naslovu referenčnega laboratorija Skupnosti: https://ec.europa.eu/jrc/en/eurl/feed-additives/evaluation-reports.