type: wikipedia

text:
Stakčín je obec na Slovensku v okrese Snina. Obec sa nachádza v údolí rieky Cirocha, medzi Sninou a Starinou, pri sútoku potokov Ternovec a Oľchovec. Je obkolesená na juhu južným úpätím masívu Nastaz, ktorý je súčasťou Bukovských vrchov a Vihorlatským pohorím. Obec je vstupnou bránou do Národného parku Poloniny. Karpaty. Lesná prevadzka Chotina .
 Ulice
 Slovenského národného povstania, Dlhá, Duchnovičova, Parková, Sadová, Ševčenkova, Švermova, Záhradná, Československej armády, Fučíkova, Lesná, Cirkevná, Dobrianskeho, Partizánska, Mieru, Duklianská
 Vodné toky
 Cirocha
 Oľchovec
 Kolonička
 Chotinka
 Ternovec
 Dejiny
 O osídlení tejto oblasti už v dobe bronzovej, teda v období na prelome 2. a 1. tisícročia pred naším letopočtom, naznačuje nález zachovalej bronzovej sekerky s tuľajkou a s uškom, zdobenej plastickými rebrami. Našla sa juhovýchodne od Stakčína, blízko cesty vedúcej do Uble pri výkopových prácach pre elektrické vedenie v roku 1964.
 V roku 1317 daroval Karol Róbert šľachticovi Filipovi Drugethovi početné rozsiahle územné majere. Medzi darovanými bola aj dedina Stakčín. Pričom v darovacej listine je o nej prvá správa z roku 1492.
 V 2. polovici 14. storočia sa do Stakčína prisťahovalo početné rusínske obyvateľstvo so šoltýsom a postupne nadobudlo v dedine úplnú prevahu. Syn tamojšieho šoltýsa bol od roku 1492 členom zbojníckej a zločineckej skupiny. Práve z roku 1492 je zachovaná prvá písomná zmienka o obci Stakčín. V bardejovskom archíve sa nachádza list, v ktorom odosielatelia vypovedali bardejovským mešťanom nepriateľstvo za popravu svojich druhov. Pisateľom bola zbojnícka družina (mala 50 členov) na čele s Fedorom Hlavatým, rodákom z Ruskej Volovej. Prvé údaje sú zachované z 30.3.1492, keď zbojnícka družina prepadla panské majetky pri Svidníku. V zozname sa nachádza aj Hricov syn Miha zo Stakčína.
 V 15. – 16. storočí v obci existovala pravoslávna cerkev, ale písomné správy sú až od 17. storočia. Stakčínske valašské domácnosti boli v roku 1567 zdanené daňou kráľovi od 8,5 porty.
 V roku 1600 tu bolo obývaných 61 domov, 1 – 2 domy šoltýsov, dom farára a chrám. V roku 1612 sa v Stakčíne nachádzal vodný mlyn a píla. V rokoch 1641 – 1645 sa rozšírila epidémia cholery, ktorá takmer o polovicu znížila počet obyvateľov. Následkom toho sa zhoršili sociálne pomery, rozšírilo zbojníctvo. V roku 1657 roľníci odopreli poslušnosť pánovi a vzniklo roľnícke povstanie „Ruthénske“ (Rusínske). V roku 1660 bol v Stakčíne zákonom chránený dubový lesík, ktorý obhospodarovala hostonická kúria a stakčínska píla, ktorá dodávala dosky a trámy pre humenský kaštieľ.
 V roku 1703 sa občania Stakčína a okolitých obcí zapojili do Rákociho povstania, lebo sa nazdávali, že získajú svoje staré práva. V roku 1728 sa spomínajú dve hájovne, ktoré slúžili pre ochranu lesov a boli majetkom panstva. V roku 1725 žil v obci 1 arendátor. V roku 1772 bol postavený gréckokatolícky chrám a súčasne aj fara.
 V roku 1806 bol vlastníkom Stakčínskeho panstva barón Johan Fröhlinch. V rokoch 1812 – 1818 v obci pôsobil gréckokatolícky kňaz Vasiľ Duchnovič (otec Alexandra V. Duchnoviča).
 V roku 1957 bol zbúraný gréckokatolícky chrám z roku 1772. Príčinou bolo likvidácia gréckokatolíckej cirkvi (po akcii P) komunistami a násilné presadzovanie pravoslávia. V marci 1959 bola dokončená výstavba novej modernej školy. V roku 1994 bol posvätený novopostavený gréckokatolícky chrám Pokrovu (Ochrany) presvätej Bohorodičky. Chrám bol postavený na pôvodných základoch chrámu, ktorý zbúrali v 50-tych rokoch po likvidácii gréckokatolíckej cirkvi.
 Názvy obce
 1567 – Ztaxin
 1773 – Strakcžín
 1808 – Stakčín (maď. Sztakcsin, Takcsány)
 Kultúra a zaujímavosti
 Stavby a pamiatky
 Pravoslávny chrám svätej Trojice - stavba, ktorá bola postavená v 20. storočí v byzantskom štýle. Slúži ako chrám pre pravoslávnych veriacich v obci.
 Gréckokatolícka cerkev Ochrany (Pokrovu) presvätej Bohorodičky - stavba, ktorá bola postavená v 20. storočí na pôvodných základoch chrámu z roku 1772, ktorý zbúrali v 50-tych rokoch po likvidácii gréckokatolíckej cirkvi komunistickým režimom. Slúži ako chrám pre gréckokatolíckych veriacich v obci.
 Rímskokatolícky kostol svätého Pia X. postavený v roku 1995.
 Hospodárstvo a infraštruktúra
 Doprava
 Obyvatelia obce si môžu vybrať z dvoch druhov dopravy: autobusovú alebo vlakovú.
 Autobusová doprava celkový počet autobusových zastávok v obci je 8.
 Vlaková doprava obec má jednu železničnú stanicu, ktorá je najvýchodnejšou vlakovou stanicou na Slovensku. Železnica v obci existuje už od roku 1909 kedy bola dokončená trať medzi Humenným, Sninou a Stakčínom.
 Priemysel
 V obci pôsobí poľnohospodárska a strojnícka spoločnosť.
 Školstvo
 V obci sa nachádza jedna ZŠ s MŠ. Výstavba novej modernej školy bola dokončená v marci 1959.
 Referencie
 Iné projekty
 Externé odkazy
 Obce okresu Snina
 Rusínske obce okresu Snina


type: other

jurisdiction: US

text: b" U.S. Department of Agriculture\n\n Office of Inspector General\n Southwest Region\n\n\n\n\n Audit Report\n\n Agricultural Marketing Service\nLivestock Mandatory Price Reporting System -\n Application Controls\n\n\n\n\n Report No. 01099-4-Te\n December 2004\n\x0c UNITED STATES DEPARTMENT OF AGRICULTURE\n OFFICE OF INSPECTOR GENERAL\n\n Washington D.C. 20250\n\n\n\n\nDATE: December 22, 2004\n\nREPLY TO\nATTN OF: 01099-4-Te\n\nSUBJECT: Livestock Mandatory Price Reporting System - Application Controls\n\nTO: A. J. Yates\n Chief\n Agricultural Marketing Service\n\nATTN: David Lewis\n Director, Compliance Staff\n Agricultural Marketing Service\n\n\nThis report presents the results of the subject audit. Your response to the official draft report,\ndated December 1, 2004, is included in its entirety as exhibit A with excerpts and the Office of\nInspector General\xe2\x80\x99s position incorporated into the Findings and Recommendations section of the\nreport. Your response contained sufficient justification to reach management decisions on all\nrecommendations contained in the report.\n\nPlease follow Departmental and your internal agency procedures in forwarding final action\ncorrespondence to the Office of the Chief Financial Officer, Director, Planning and\nAccountability Division. Final action on the management decisions should be completed within\n1 year of the date of the management decisions to preclude being listed in the Department\xe2\x80\x99s\nannual Performance and Accountability Report.\n\nWe appreciate the courtesies and cooperation extended to us by members of your staff during the\naudit. If you have any questions, please contact me at 720-6945, or have a member of your staff\ncontact Richard J. Davis, Director, Administration and Finance Division, at 720-1918.\n\n\n\n/s/ R. W. Young\nROBERT W. YOUNG\nAssistant Inspector General\n for Audit\n\x0cExecutive Summary\nAgricultural Marketing Service\nLivestock Mandatory Price Reporting System - Application Controls\n(Report No. 01099-4-Te)\n\nResults in Brief This report presents the results of our application controls audit of the\n Agricultural Marketing Service\xe2\x80\x99s (AMS) Livestock Mandatory Price\n Reporting System (LMPRS). Our objective was to evaluate whether\n AMS had adequate controls over the input, processing, and output of\n LMPRS data. These controls include ensuring the authorization,\n completeness, and accuracy of the LMPRS data. AMS relies on LMPRS to\n provide information on pricing, contracting for purchase, and supply and\n demand conditions for livestock, livestock production, and livestock\n products, that can be readily understood by producers, packers, and other\n market participants. Overall, we found that AMS had authorization,\n completeness, and accuracy controls for LMPRS data; however, the controls\n need to be improved.\n\n The LMPRS application owner is the Livestock and Grain Market News\n Branch (MNB) of AMS. We found that MNB did not have adequate\n LMPRS application controls including access controls, technical\n documentation for the application, mandatory report modification process,\n supervisory reviews, and application monitoring. LMPRS access controls\n were not limited to the least privilege concept, defined as granting only the\n access required for a user\xe2\x80\x99s job responsibilities. While the technical system\n documentation for LMPRS is extensive, it did not provide a complete view\n of all files and database tables used within each module of the application.\n LMPRS reports were modified by MNB reporters, and there was no\n second-party review before the reports were posted on the AMS website.\n There were no routine supervisory reviews of MNB reporters\xe2\x80\x99 work and no\n documentation of reviews that were performed. Reviews of the daily\n LMPRS operation needed to be improved including monitoring logs and\n authorized user tables. Therefore, LMPRS application had an increased\n vulnerability in several areas that could result in unauthorized access and\n errors in mandatory reports that were posted on the AMS website for the\n public\xe2\x80\x99s use. However, there was no evidence that any instances of\n unauthorized access have occurred. During our fieldwork, MNB initiated\n action to ensure LMPRS user access was based on least privilege.\n\n We also found that MNB did not have adequate management controls to\n ensure that Federal and Departmental guidance on information technology\n issues was implemented. The LMPRS security plan did not meet Federal and\n Departmental requirements, including warning banner displays, password\n expiration, and the locking out of administrator accounts. In addition,\n\nUSDA/OIG-A/01099-4-Te Page i\n\x0c MNB had not submitted any of the required data to address identified\n weaknesses for the agency Plan of Action and Milestones. MNB also was not\n performing scans of the LMPRS network. MNB was not aware of these\n requirements, and the AMS Chief Information Officer had not made it a\n practice to provide information on these items unless a request was received\n due to the workload and loss of staff. We also found that the\n LMPRS application had not been certified before it went into production in\n April 2001. Officials did not adhere to Departmental guidance and stated that\n application certifications were not a priority throughout the Government at that\n time. The absence of a system certification increases the risk that the\n LMPRS application could be vulnerable to security breaches and\n cyber-related attacks. During our fieldwork, MNB corrected one security\n plan deficiency (banner display). They also instituted scans for LMPRS\n application servers.\n\nRecommendations\nIn Brief\n We recommend that AMS:\n\n \xe2\x80\xa2 Establish and implement application controls to strengthen access\n privileges, report modifications, supervisory reviews, technical\n documentation, and application monitoring.\n \xe2\x80\xa2 Establish and implement management controls to ensure that Federal and\n Departmental guidance is followed regarding the security plan, Plan of\n Action and Milestones, application certification, and scans.\n\nAgency Response In a letter dated December 1, 2004, and subsequent correspondence,\n AMS concurred with all of the findings and recommendations and provided\n proposed actions and completion dates for each recommendation.\n (See exhibit A.)\n\nOIG Position We accept the management decisions for all of the recommendations\n contained in the report. For final action, AMS needs to provide the Office of\n the Chief Financial Officer, Director, Planning and Accountability\n Division (OCFO/PAD), documentation as outlined in the Office of Inspector\n General\xe2\x80\x99s (OIG) Position sections of the report.\n\n\n\n\nUSDA/OIG-A/01099-4-Te Page ii\n\x0cAbbreviations Used in This Report\n\n\nADP Automated Data Processing\nAMS Agricultural Marketing Service\nCIO Chief Information Officer\nDM Departmental Manual\nGAO Government Accountability Office\nIT Information Technology\nLMPRS Livestock Mandatory Price Reporting System\nMNB Livestock and Grain Market News Branch of AMS\nNIST National Institute of Standards and Technology\nOCFO/PAD Office of the Chief Financial Officer, Director,\n Planning and Accountability Division\nOCIO Office of the Chief Information Officer\nOIG Office of Inspector General\nOMB Office of Management and Budget\nPOA&M Plan of Action and Milestones\nUSDA U. S. Department of Agriculture\n\n\n\n\nUSDA/OIG-A/01099-4-Te Page iii\n\x0cTable of Contents\nExecutive Summary .................................................................................................................................i\n\n\nAbbreviations Used in This Report ......................................................................................................iii\n\n\nBackground and Objectives ................................................................................................................... 1\n\n\nFindings and Recommendations............................................................................................................ 3\n\n\n Section 1 Application Controls Need Improvement ................................................................... 3\n\n Finding 1 LMPRS Application Controls Were Inadequate .................................................... 3\n Recommendation No. 1.................................................................................... 7\n Recommendation No. 2.................................................................................... 8\n Recommendation No. 3.................................................................................... 8\n Recommendation No. 4.................................................................................... 9\n Recommendation No. 5.................................................................................... 9\n Recommendation No. 6.................................................................................. 10\n\n Section 2 Management Controls Need Improvement ............................................................... 11\n\n Finding 2 Information System Documentation and Policies Need Improvement ................. 11\n Recommendation No. 7.................................................................................. 15\n Recommendation No. 8.................................................................................. 15\n Recommendation No. 9.................................................................................. 16\n Recommendation No. 10................................................................................ 16\n Recommendation No. 11................................................................................ 16\n Recommendation No. 12................................................................................ 17\n\nGeneral Comments ............................................................................................................................... 18\n\n\nScope and Methodology........................................................................................................................ 19\n\nExhibit A \xe2\x80\x93 Agency Response .............................................................................................................. 21\n\n\n\n\nUSDA/OIG-A/01099-4-Te Page iv\n\x0cBackground and Objectives\nBackground Application controls are the structure, policies, and procedures that apply to\n separate, individual application systems. An application system is typically a\n collection or group of individual computer programs that relate to a common\n function. In the Federal Government, some applications may be complex,\n comprehensive systems involving numerous computer programs and\n organizational units, such as those associated with benefit payment systems.\n Application controls can encompass both the routines contained within the\n computer program code and the policies and procedures associated with user\n activities, such as manual measures performed by the user to determine that\n data was processed accurately.\n\n Application controls help make certain that transactions are valid, properly\n authorized, and completely and accurately processed. They are commonly\n categorized into three phases of a processing cycle:\n\n \xe2\x80\xa2 Input\xe2\x80\x94data are authorized, converted to an automated form, and entered\n into the application in an accurate, complete, and timely manner.\n\n \xe2\x80\xa2 Processing\xe2\x80\x94data are properly processed by the computer and files are\n updated correctly.\n\n \xe2\x80\xa2 Output\xe2\x80\x94files and reports generated by the application actually occur and\n accurately reflect the results of processing and reports are controlled and\n distributed to the authorized users.\n\n AMS\xe2\x80\x99 LMPRS Application\n\n The U.S. Department of Agriculture's (USDA) Agricultural Marketing Service\n (AMS) administers programs that facilitate the efficient, fair marketing of\n U.S. agricultural products, including food, fiber, and specialty crops.\n AMS includes six commodity divisions: Cotton, Dairy, Fruit and Vegetable,\n Livestock and Feed, Poultry, and Tobacco.\n\n AMS\xe2\x80\x99 Livestock Mandatory Price Reporting System (LMPRS) contains\n information about livestock pricing, contracting arrangements, and supply and\n demand conditions. The Livestock and Grain Market News Branch (MNB) of\n AMS implemented the LMPRS in April 2001 in response to the Livestock\n Mandatory Reporting Act of 1999 (Act), part of the Fiscal Year 2000\n Agricultural Appropriation Bill. Under the Act, larger livestock packers,\n processors, and importers electronically report certain market information\n regarding transactions of cattle, swine, lamb, and livestock products to USDA.\n LMPRS is designed to collect the information and summarize it in the form of\n national reports, which are available to the public on the AMS website.\n\x0c Approximately 134 meat processing plants submit mandatory data to the\n LMPRS application on a daily and weekly basis. At least two times each day,\n reporters in the MNB field offices in Des Moines, Iowa, and St. Joseph,\n Missouri, manually import the market information received from the plants\n into the LMPRS production database. The reporters have approximately\n 1 hour from importing the data to create reports and post them to the\n AMS website.\n\n The LMPRS application servers are located at two sites - Ashburn, Virginia\n (primary servers), and Richardson, Texas (secondary servers). The LMPRS\n network is external to the Department\xe2\x80\x99s network, which was unable to\n accommodate LMPRS activity.\n\n Three contractors and one subcontractor support the LMPRS application. The\n application contractor developed and maintains the application and is also the\n system administrator for the LMPRS application. The facility contractor\n stores AMS-owned servers and other hardware on its property in a secure and\n protected room. The hardware maintenance contractor provides maintenance\n functions for hardware switch configuration and supports the firewalls used to\n protect the LMPRS application. The firewall subcontractor manages the\n LMPRS firewall and intrusion detection systems.\n\n The following diagram illustrates the data flow of the LMPRS application:\n\n\n `\n Meat Processing Plants\n\n Ashburn, VA (Primary Servers) Firewall\n\n\n\n\n AMS Users\n\n Internet\n\n\n USDA Network\n\n Richardson, TX (Secondary Servers)\n\n\n Firewall\n\n\n\n\nObjective The objective of this audit was to determine whether AMS had established\n adequate controls to ensure that data entered into LMPRS are properly\n authorized, completely processed, and accurately processed.\n\x0cFindings and Recommendations\nSection 1 Application Controls Need Improvement\n\n\n\n Finding 1 LMPRS Application Controls Were Inadequate\n\n Our review of LMPRS application controls disclosed several weaknesses\n involving the assignment of access privileges, reviews by supervisors of\n modified reports, technical documentation, reviews and documentation of\n reporter\xe2\x80\x99s daily activities, and reviews of the daily operations of the\n LMPRS application. The causes of the weaknesses in each of the five areas\n are outlined in the sections below. As a result, the LMPRS application has\n an increased vulnerability in several areas that could result in unauthorized\n access and errors in mandatory reports that are posted on the AMS website.\n (Although, we did not identify any instances of unauthorized access.)\n\n Access Controls\n\n An excessive number of LMPRS users had access privileges that exceeded\n the needs of their job responsibilities. Inadequate internal controls allowed\n MNB staff to routinely assign the same access privilege to internal users\n without considering the users\xe2\x80\x99 job responsibilities. As a result, the\n LMPRS application had an increased risk of unauthorized use, such as the\n creation and deletion of valid/invalid users or unauthorized access to valid\n LMPRS accounts.\n\n Federal,1 Departmental,2 and National Institute of Standards and Technology\n (NIST)3 guidance state users should be granted access based on the least\n privilege concept. Least privilege refers to the security objective of granting\n users only those accesses they need to perform their official responsibilities.\n\n Access controls over system and application data include both physical and\n logical controls and should provide reasonable assurance that computer\n resources (data files, application programs, and computer equipment) are\n protected against unauthorized modification, disclosure, loss, or impairment.\n Logical access controls, such as user names, passwords, and access\n permissions, ensure that only authorized users have access to network\n resources from their workstations, and that users are granted only the access\n that is needed to conduct their job responsibilities.\n\n\n\n\n1\n Office of Management and Budget (OMB) Circular A-130, Appendix III, \xe2\x80\x9cSecurity of Federal Automated Information Resources,\xe2\x80\x9d section A, dated\nNovember 28, 2000\n2\n Departmental Manual (DM) 3140-1, Management ADP Security Manual, Appendix D, section 7 - Vulnerability to Unauthorized Disclosure, dated\nJuly 19, 1984\n3\n NIST SP800-12, An Introduction to Computer Security: The NIST Handbook, Chapter 10, section 10.2.1, dated October 1995\n\x0c There were three groups of users who accessed LMPRS: AMS users4\n (47 user accounts), meat processing plant users (134 user accounts), and\n LMPRS system administrators (4 user accounts - all application contractors).\n AMS and meat processing plant user accounts are created and deleted by\n MNB information technology (IT) specialists. Meat processing plant users\n have a \xe2\x80\x9cplant\xe2\x80\x9d access profile, which allows limited privileges. An AMS user\n can have a \xe2\x80\x9creporter\xe2\x80\x9d access profile, an \xe2\x80\x9cadministrator\xe2\x80\x9d access profile, or a\n \xe2\x80\x9creporter/administrator\xe2\x80\x9d profile. An LMPRS user with the \xe2\x80\x9cadministrator\xe2\x80\x9d\n access profile is allowed to modify users and passwords for the\n LMPRS application. The type of profile is chosen when MNB IT specialists\n create the AMS user account.\n\n MNB staff stated that they routinely gave AMS users both \xe2\x80\x9creporter\xe2\x80\x9d and\n \xe2\x80\x9cadministrator\xe2\x80\x9d access profiles. We found 36 of 47 AMS users had\n \xe2\x80\x9cadministrator\xe2\x80\x9d access profiles. MNB stated that this had occurred due to the\n need to allow the reporters access to other data that was needed for their job\n responsibilities and because the staff routinely gave both profiles to\n AMS users. In a prior audit report,5 OIG found that least privilege was an\n issue for other AMS applications that were reviewed. During our fieldwork,\n MNB modified which AMS users were allowed access to the\n LMPRS application and had the contractor modify the users\xe2\x80\x99 access profiles.\n After the modifications, there were nine users with the\n \xe2\x80\x9creporter/administrator\xe2\x80\x9d profile (six AMS users and three application\n contractors) whose job responsibilities required the access profile.\n\n Report Modification\n\n Some LMPRS application reports were routinely modified and posted on the\n website without further review. MNB did not have adequate internal controls\n to ensure that modified reports were subject to a second-party review by\n reporters\xe2\x80\x99 peers before being published on the AMS website. The\n supervisors considered the reporters experts and did not feel a review was\n necessary. As a result, there was an increased risk of errors in the mandatory\n reports posted on the AMS website for public use.\n\n MNB desk procedures require reporters to review the reports they produce\n before posting on the AMS website. Reporters work in pairs and review\n portions of each other\xe2\x80\x99s work. However, the desk procedures did not require\n second-party review of reports before they were posted on the website.\n Federal guidance6 states internal controls should provide reasonable\n assurance that the objectives of the agency are being achieved, including\n reliability of reports for internal and external use, and should be designed to\n assure that ongoing monitoring occurs in the course of normal operations.\n Internal controls should be performed continually and be ingrained in the\n\n4\n AMS users consist of AMS Audit Review and Compliance Auditors and MNB users.\n5\n Audit Report No. 01099-1-FM, \xe2\x80\x9cSecurity Over Information Technology Resources at the Agricultural Marketing Service,\xe2\x80\x9d dated March 2002\n6\n Government Accountability Office (GAO), Standards for Internal Control in the Federal Government, Introduction and Monitoring Sections, dated\nNovember 1999\n\x0c agency\xe2\x80\x99s operations, including regular management and supervisory\n activities, comparisons, reconciliations, and other actions people take in\n performing their duties.\n\n During our fieldwork, we observed the modification of two daily mandatory\n reports before they were posted on the AMS website. A trend number for a\n swine report was manually calculated and then changed, and data for a boxed\n beef report was modified to meet mandatory confidentiality criteria. We\n determined that the trend number could be calculated by the application if a\n modification was made to the application. MNB officials were aware of this\n and had requested changes to the LMPRS application about 2 years ago. Due\n to a change in personnel, the issue was never resolved. MNB supervisors\n explained that there was no second-party review because the reporters are\n considered the experts. MNB officials requested the application contractor\n determine what type of effort would be involved in making a program change\n to the trend calculation. However, the confidentiality data for the boxed beef\n report could not be handled by the application because parameters change\n frequently. During our fieldwork, MNB officials agreed that it was\n reasonable to pursue establishing procedures for second-party reviews of\n LMPRS reports.\n\n Technical Documentation\n\n While the technical system documentation for LMPRS is extensive, it did not\n provide a complete view of all files and database tables used within each\n module of the application. MNB did not have adequate internal controls\n requiring detailed technical documentation because they felt the\n documentation MNB requested of the contractor was adequate. In addition,\n MNB relied heavily on the current application contractor to provide technical\n information for the LMPRS application. There was a risk of system\n downtime if the current MNB application contractor was no longer available.\n\n Departmental7 guidance states that agencies with new or significantly\n modified application systems should assure the development of adequate\n systems, program, operational, and user documentation and recognize8 the\n risk of a heavy reliance on contractors or other related parties to perform\n critical agency functions.\n\n NIST guidance9 states documentation of all aspects of computer support and\n operations is important to ensure continuity and consistency. The guidance\n also states formalizing operational practices and procedures in sufficient\n detail helps to eliminate security lapses and oversights, gives new personnel\n sufficiently detailed instructions, and provides a quality assurance function to\n help ensure that operations will be performed correctly and efficiently.\n\n\n7\n DM 3140-1, Management ADP Security Manual, Section 17 - Application System Development, dated July 19, 1984\n8\n DM 1110-2, Management Control Manual, Chapter 2, section 5 - Guidelines for Developing a Management Control Process, dated November 29, 2002\n9\n NIST SP800-12, An Introduction to Computer Security: The NIST Handbook, Chapter 14, section 14.6, dated October 1995\n\x0c The contractor provided a user guide for plant users and an administrator\xe2\x80\x99s\n guide for MNB users. There also is contractor-provided documentation for\n certain program functions used by the application and a high-level flowchart\n of the application. However, there is no comprehensive technical\n documentation that describes all of the application\xe2\x80\x99s tables and files\n including how transactions flow through the application. MNB felt that the\n original documentation requested from the contractor was sufficient.\n However, MNB officials have agreed that additional technical documentation\n should be obtained and stated the application contractor would be consulted\n on this issue.\n\n Supervisory Reviews\n\n MNB field office staff did not routinely perform supervisory reviews of\n MNB reporters\xe2\x80\x99 daily activities, and the reviews that were performed were\n not documented. MNB did not have adequate internal controls for review of\n MNB reporters\xe2\x80\x99 daily activities because supervisors did not believe it was\n necessary. There is an increased risk of errors occurring in the mandatory\n report process.\n\n Federal guidance10 states internal control should generally be designed to\n assure that ongoing monitoring occurs in the course of normal operations,\n that it is performed continually and is ingrained in the agency\xe2\x80\x99s operations,\n and that it includes regular management and supervisory activities,\n comparisons, reconciliations, and other actions people take in performing\n their duties.\n\n We interviewed supervisors and managers at the Des Moines field office.\n They stated that there was no documentation of, or consistent schedule for,\n supervisory reviews of the reporters\xe2\x80\x99 work, including transactions that are\n excluded from the mandatory LMPRS reports posted on the AMS website.\n The reporters submit a Daily Report Log, which summarizes the reporting\n activities each day, to supervisors. The Daily Report Logs contain the time\n of import of records, list of packers not submitting data and reason and\n percentage of records excluded, and the percent of records used in the\n reports. However, the supervisors do not routinely review the reporters\xe2\x80\x99\n daily work that is summarized in the logs. MNB supervisors stated that the\n reporters were experts and that they trusted the reporters\xe2\x80\x99 judgment in\n making decisions.\n\n Application Monitoring\n\n MNB did not routinely monitor the daily operations of the application such\n as adequately reviewing database tables containing authorized users, firewall\n logs, and web server logs. MNB did not have adequate internal controls in\n place because officials were satisfied with their current monitoring activities.\n\n10\n GAO, Standards for Internal Control in the Federal Government, Monitoring Section, dated November 1999\n\x0c Insufficient monitoring may increase the vulnerability of LMPRS to attacks,\n including inappropriate or unauthorized access and potential system\n downtime.\n\n Federal guidance11 states internal control should generally be designed to\n assure that ongoing monitoring occurs in the course of normal operations,\n that it is performed continually and is ingrained in the agency\xe2\x80\x99s operations,\n and that it includes regular management and supervisory activities,\n comparisons, reconciliations, and other actions people take in performing\n their duties. The guidance12 also states management should ensure that skill\n needs are continually assessed and that the organization is able to obtain a\n workforce that has the required skills that match those necessary to achieve\n organizational goals. Training should be aimed at developing and retaining\n employee skill levels to meet changing organizational needs.\n\n While the contractor monitors the firewall logs, MNB officials receive a\n summary of these logs daily, which contains the top threats and top threat\n sources for that day. MNB officials stated that they did not know much\n about the firewall logs. We obtained examples of the types of training the\n MNB IT staff had recently received; however, the list did not include any\n type of firewall training. MNB was not performing reviews of the authorized\n application users and web server access logs. The web server logs contain\n transaction data of submissions and retrievals of information from the\n application. The transactions that are recorded by these logs also can be used\n to monitor the date and time LMPRS users accessed the application.\n MNB officials stated they have routine meetings with the application\n contractor; however, there were no routine reviews of server logs.\n MNB officials did not have routine meetings with the other two contractors\n (firewall and facility).\n\nRecommendation No. 1\n\n Establish and implement application controls to ensure that LMPRS users\n are given only the access privileges required for assigned job duties.\n\n Agency Response. AMS concurs with this recommendation. During the\n review, MNB staff modified the user access privileges to ensure that only\n those users whose job responsibilities require Administrator access have that\n privilege. No later than May 31, 2005, AMS will develop written procedures\n that will be incorporated in the Trusted Facilities Manual, developed during\n the certification and accreditation process, for MNB IT staff to follow when\n establishing new AMS and plant user accounts to ensure that Administrator\n access is given only to those users that require it.\n\n\n\n\n11\n GAO, Standards for Internal Control in the Federal Government, Monitoring Section, dated November 1999\n12\n GAO, Standards for Internal Control in the Federal Government, Managing Human Capital, dated November 1999\n\x0c OIG Position. We accept the AMS management decision for\n Recommendation No. 1. In our opinion, final action will be completed\n when AMS provides OCFO/PAD documentation of the written procedures\n that have been developed to ensure that Administrator access is given only\n to AMS and plant user accounts that require it.\n\nRecommendation No. 2\n\n Determine all the mandatory reports that are modified before posting to the\n AMS website. For each report that is modified, (a) establish and implement\n application controls to ensure that the report is reviewed for correctness\n before being posted on the website, and (b) where possible, change the\n application to perform the needed functions.\n\n Agency Response. AMS concurs with this recommendation. No later\n than May 31, 2005, MNB will determine all of the mandatory reports that\n are modified prior to being posted on the AMS website and will establish\n written procedures in an LMPRS reporter desk manual to ensure that all of\n the reports are subject to a second-party review by another reporter prior to\n publication. With respect to the reports that are being modified due to\n confidentiality concerns, AMS has determined that it is not possible to\n modify the application to perform this function. With respect to the swine\n reports in which a trend number is manually calculated, AMS will pursue\n modifying the application to perform this function in the next swine\n enhancement effort, which is anticipated to occur in fiscal year 2006.\n\n On December 8, 2004, AMS provided correspondence with the following\n clarification: With respect to the AMS response to Recommendation No. 2,\n the swine reports that are modified to manually calculate the trend number\n will be subject to the second-party review procedures that AMS will\n establish, no later than May 31, 2005, until such time that the application is\n modified to perform this function.\n\n OIG Position. We accept the AMS management decision for\n Recommendation No. 2. In our opinion, final action will be completed when\n AMS provides OCFO/PAD documentation of the written procedures that\n have been developed to ensure the correctness of modified reports.\n\nRecommendation No. 3\n\n Obtain necessary technical documentation for LMPRS.\n\n Agency Response. AMS concurs with this recommendation. While\n AMS believes the current technical documentation for LMPRS is extensive,\n as a part of the contract that was awarded in September 2004 for the fiscal\n year 2004 enhancements, additional system documentation will be\n developed that details all of the application\xe2\x80\x99s tables and files, including how\n\x0c transactions flow through the applications. This will be completed no later\n than May 31, 2005.\n\n OIG Position. We accept the AMS management decision for\n Recommendation No. 3. In our opinion, final action will be completed when\n AMS provides OCFO/PAD evidence of the additional LMPRS\n documentation.\n\nRecommendation No. 4\n\n Establish and implement application controls for reviews of MNB reporters\xe2\x80\x99\n activities, including documentation of the reviews.\n\n Agency Response. AMS concurs with this recommendation. No later\n than May 31, 2005, MNB will develop procedures to be incorporated in the\n LMPRS reporter desk manual to document weekly reviews of\n MNB reporters\xe2\x80\x99 activities, including transactions that were excluded from\n the LMPRS reports, by the appropriate supervisor(s).\n\n OIG Position. We accept the AMS management decision for\n Recommendation No. 4. In our opinion, final action will be completed when\n AMS provides OCFO/PAD documentation of the written procedures that\n have been developed to ensure supervisory reviews of MNB reporters\xe2\x80\x99\n activities are performed and documented.\n\nRecommendation No. 5\n\n Establish and implement application controls for review of the daily\n operations of the LMPRS application.\n\n Agency Response. AMS concurs with this recommendation. No later\n than May 31, 2005, AMS will establish and implement controls to review\n the daily operations of the LMPRS application. As a part of the contract that\n was awarded in September 2004 for the fiscal year 2004 enhancements, the\n LMPRS application will generate a nightly audit report that will include\n items such as the number of imports run (including details for each import),\n total LMPRS records processed, total LMPRS bad records detected, the\n number of reports run (including details for each report), user account\n details, and other application information.\n\n OIG Position. We accept the AMS management decision for\n Recommendation No. 5. In our opinion, final action will be completed when\n AMS provides OCFO/PAD documentation of the written procedures that\n have been developed to review the daily operations of the LMPRS\n application.\n\x0cRecommendation No. 6\n\n Establish and implement application controls to ensure that the appropriate\n personnel receive adequate training to monitor the LMPRS application.\n\n Agency Response. AMS concurs with this recommendation. AMS has\n outsourced both the overall administration of the system, including\n management of the system firewalls, to third-party contractors.\n AMS believes these contractors have the qualifications and skills necessary\n to effectively carry out these tasks. In the event that additional expertise is\n needed to review either firewall logs or other system functions, agency\n IT personnel are available to MNB for consultation as needed. If AMS\n believes further training is needed for overall program management,\n AMS will pursue obtaining additional training as appropriate.\n\n OIG Position. We accept the AMS management decision for\n Recommendation No. 6. The proposed actions, in our opinion, are sufficient\n for final action.\n\x0cSection 2 Management Controls Need Improvement\n\n\n\nFinding 2 Information System Documentation and Policies Need\n Improvement\n\n Our review of the LMPRS application disclosed several conditions that were\n not in accordance with Federal and Departmental guidance. The security\n plan did not address all requirements. MNB did not submit Plan of Action\n and Milestones (POA&M) data to address LMPRS application weaknesses.\n MNB had not certified the LMPRS application or performed scans of the\n LMPRS network for system vulnerabilities. The cause of the conditions was\n that AMS had inadequate management controls to ensure Federal and\n Departmental guidance was followed, as outlined in the sections below. As\n a result, the LMPRS application could be vulnerable to security breaches and\n cyber-related attacks.\n\n Security Plan\n\n The LMPRS security plan did not address all Federal and Departmental\n requirements including waivers for noncompliance with policies requiring\n warning banner displays, user password expiration, and locking out of\n administrator accounts on the LMPRS servers. In addition, the security plan\n did not indicate the current status of all elements outlined in the security plan\n guidance. AMS\xe2\x80\x99 CIO had not informed MNB of the requirements outlined\n in the guidance. Thus, MNB officials were not aware of all the requirements\n outlined by the guidance. As a result, the LMPRS application could be\n vulnerable to security breaches.\n\n Federal guidance13 states that all major applications and general support\n systems containing sensitive information require protection to assure their\n integrity, availability, or confidentiality, and therefore require security plans.\n Departmental guidance requires warning14 banners, password15 expiration,\n and locking out of user accounts.16 Further,17 when it is not feasible to apply\n a particular standard to an existing automated data processing (ADP) system\n without excessive costs, agencies are to devise an alternate scheme for\n adequate protection and then request a waiver. Office of the Chief\n Information Officer (OCIO) guidance18 also requires the security plan to\n discuss upcoming agency plans for implementing the agency security\n awareness, training, and education programs including planned annual\n\n\n13\n OMB Circular A-130, Appendix III, \xe2\x80\x9cSecurity of Federal Automated Information Resources,\xe2\x80\x9d section A, dated November 28, 2000\n14\n Departmental Regulation 3140-1, USDA Information Systems Security Policy, Section 15 - System Warning Message, dated May 15, 1996\n15\n DM 3140-1, Management ADP Security Manual, Appendix D, section 6, part b, dated July 19, 1984\n16\n DM 3140-1, Management ADP Security Manual, Appendix D, section 5 - Requirements, dated July 19, 1984\n17\n DM 3140-1, Management ADP Security Manual, Section 7 - Security Program Requirements, dated July 19, 1984\n18\n OCIO Cyber Security (CS)-25,Annual Agency Security Plans for Information Technology Systems and Security Programs Guidance, dated\nApril 8, 2003\n\x0c security seminars. The Departmental OCIO\xe2\x80\x99s office issued a letter19 stating\n annual security plans are recognized as one tool to assess and report on the\n protection of agency assets. Therefore, it is critical that they be\n prepared/updated on a regular basis with the most current information\n concerning each agency\xe2\x80\x99s information security practices.\n\n The most recent LMPRS security plan, dated January 6, 2004, stated, \xe2\x80\x9cThe\n LMPRS does not display banners or legal notices prior to the display of the\n logon dialog box. Implementing this would require an administrator to\n physically click \xe2\x80\x98ok\xe2\x80\x99 to get past the desktop, which would prevent certain\n critical applications in the startup group not to start without a manual\n interface. Servers are set up to automatically reboot periodically,\n implementing the above requirement would impact this job.\xe2\x80\x9d The security\n plan also stated that LMPRS user passwords did not expire. In addition, the\n security plan stated, \xe2\x80\x9cThere is currently no lockout feature in place for the\n LMPRS servers. All accounts belong to the administrator group, and\n therefore cannot be locked out or disabled.\xe2\x80\x9d When asked about the\n above-mentioned requirements, MNB responded that it was not aware that\n waivers were required for conditions that did not comply with security plan\n guidance until notified by OIG during our fieldwork. During our fieldwork,\n MNB modified the application to display warning banners, and has initiated\n changes to the application to resolve the password expiration issue.\n MNB stated it would pursue getting a waiver for the locking out of the\n system administrator accounts from OCIO and also discuss the need to have\n the system administrator accounts lock out.\n\n The LMPRS security plan did not include the frequency of security training,\n as required by the OCIO guidance stated above. MNB stated that there was\n annual security training for personnel as well as training on the\n LMPRS application before using the application, even though it was not\n noted in the security plan. Also, the wording in the security plan did not\n always indicate the current status of the element being reported on. For\n instance, the word \xe2\x80\x9cshould\xe2\x80\x9d used in the Rules of Behavior section does not\n indicate if the rules are being used.\n\n Plan of Action and Milestones\n\n MNB did not prepare and submit POA&M data to address identified\n weaknesses in the LMPRS application. The AMS CIO had not informed\n MNB of the requirements outlined in the Federal guidance. Thus,\n MNB officials were not aware of all the requirements outlined by the\n Federal20 guidance. The LMPRS application could be vulnerable to any\n weaknesses that have been identified in risk assessments, network\n vulnerability scans, and audit reports.\n\n\n\n19\n OCIO Letter, Annual Agency Security Plans for Information Technology Systems and Security Programs, dated April 28, 2003\n20\n OMB, Memorandum for the Heads of Executive Departments and Agencies, M-02-01, dated October 17, 2001\n\x0c Federal guidance21 states, \xe2\x80\x9cAn agency should develop a separate POA&M\n for every program and system for which weaknesses were identified * * *.\xe2\x80\x9d\n The guidance further states, \xe2\x80\x9cThereafter, brief status updates must be\n submitted on a quarterly basis.\xe2\x80\x9d\n\n MNB was not aware of the submission requirements for a POA&M until\n notified by OIG during our fieldwork. The AMS CIO stated that his office\n was responsible for preparing the POA&M for the agency and that each\n branch was responsible for reporting vulnerabilities. We obtained a copy of\n the most recent POA&M submissions from the AMS CIO. There were no\n submissions from MNB. Although AMS\xe2\x80\x99 CIO did not make it a practice to\n send out specific communications on Departmental requirements because of\n the workload and loss of staff, the AMS CIO\xe2\x80\x99s office was available to\n consult with the branches.\n\n Since the LMPRS vulnerabilities from a recent risk assessment were not\n \xe2\x80\x9chigh\xe2\x80\x9d risk, MNB made the decision to include the complete POA&M in the\n planned certification and accreditation process due in September 2004. The\n AMS CIO stated that his office formed a new Cyber Security Branch in\n June 2004 that will be more involved with each of the AMS program areas.\n\n Certification and Accreditation\n\n The LMPRS application had not been certified and accredited. MNB did not\n follow Federal and Departmental guidance requiring certification and\n accreditation when the application went into production in April 2001 and\n had not pursued the matter since. As a result, the LMPRS application could\n be vulnerable to security breaches and cyber-related attacks.\n\n Departmental guidance22 states the need for certification is recognized by the\n OMB23 and that Federal agencies are required to certify the security of\n sensitive computer application systems and perform recertification at least\n every 3 years.\n\n MNB officials stated that when the LMPRS went into production in\n April 2001, the certification and accreditation process was not adhered to on\n a Departmental level. The Department has set September 2004 as the date\n for certifications to be completed, and MNB stated that the LMPRS\n certification process should be completed before September 2004. The\n AMS CIO agreed with the branch\xe2\x80\x99s assessment that the Department had not\n been adhering to the certification requirements in the past. The CIO stated\n that Federal guidance had not been in place for the process and had been\n recently developed. The AMS CIO also stated that his office formed a new\n Cyber Security Branch in June 2004 that will be more involved with each of\n the AMS program areas.\n\n21\n OMB, Memorandum for the Heads of Executive Departments and Agencies, M-02-01, dated October 17, 2001\n22\n DM 3140-1, Management ADP Security Manual, Section 12 - Application Certification and Recertification, dated July 19, 1984\n23\n OMB Circular A-130, Appendix III, \xe2\x80\x9cSecurity of Federal Automated Information Resources,\xe2\x80\x9d General Support Systems, dated November 28, 2000\n\x0c Network Scans\n\n The current LMPRS network was not being scanned at the time of our\n fieldwork. MNB had no formal policies and procedures in place to ensure\n network scans are completed and corrective actions are taken on\n vulnerabilities identified on the LMPRS network due to an oversight by\n officials. As a result, LMPRS servers and networks could be vulnerable to\n cyber-related attacks, jeopardizing the integrity and confidentiality of the\n data compiled on tracking and reporting livestock data.\n\n OMB Circular A-13024 requires agencies to maintain security commensurate\n with the risk and magnitude of the harm resulting from the loss, misuse, or\n unauthorized access to or modification of information. This includes\n assuring that systems and applications used by the agency operate effectively\n and provide appropriate confidentiality, integrity, and availability through\n the use of cost-effective management, personnel, operational, and technical\n controls. Departmental guidance25 requires agencies to keep an inventory of\n their network, to perform monthly network scans, and to develop and\n implement corrective action plans to address critical vulnerabilities. Federal\n guidance26 also states that contractors are held to the same security standards\n as Government entities.\n\n We used a commercially available software tool that identifies\n vulnerabilities in network components that use the Transmission Control\n Protocol/Internet Protocol (the protocol used on the public Internet). We\n found one medium-risk and no high-risk vulnerabilities on LMPRS network\n routers, switches, and servers. The medium-risk vulnerability was a\n software analysis function that was enabled and could be exploited.\n Sensitive system information could be obtained and used to further attack\n the servers.\n\n MNB officials stated that they did not realize that they needed to (1) scan\n servers before placing the servers on the network, (2) include IP addresses\n for routers and switches in the scanning process, and (3) develop corrective\n action plans to address identified vulnerabilities. In a prior audit,27 we\n reported that network scans were not being performed. The officials stated\n the internal servers that were not part of LMPRS were being scanned\n regularly as a result of the prior audit. The MNB official stated that because\n the LMPRS servers are outside the USDA network (see diagram on page 2)\n that they were overlooked. The AMS CIO stated that he was not aware that\n scans of the LMPRS network were not being performed and told the\n appropriate staff that all AMS servers should be scanned including those\n external to the USDA network. During the audit fieldwork, MNB started\n\n24\n OMB Circular A-130, Appendix III, \xe2\x80\x9cSecurity of Federal Automated Information Resources,\xe2\x80\x9d section A, dated November 28, 2000\n25\n DM 3500-2, Cyber Security Manual, Chapter 6, part 1, dated April 4, 2003\n26\n Federal Information Security Management Act of 2002, dated December 17, 2002\n27\n Audit Report No. 10099-1-FM, \xe2\x80\x9cSecurity Over Information Technology Resources at the Agricultural Marketing Service,\xe2\x80\x9d dated March 2002\n\x0c performing monthly scans of the LMPRS servers and plans to add scans of\n the switches and routers soon. Due to our audit work, AMS became aware\n that the facility contractor had a process in place for identifying and\n mitigating network vulnerabilities; however, assurance of this fact was not\n mentioned in the statement of work or contract for hosting the\n LMPRS system. The AMS CIO stated that his office formed a new Cyber\n Security Branch in June 2004 that will be more involved with each of the\n AMS program areas.\n\nRecommendation No. 7\n\n Establish and implement management controls to ensure that the\n LMPRS security plan conforms to Federal and Departmental regulations,\n including the requirement that appropriate waivers for existing and future\n LMPRS noncompliant conditions are requested and each area of the plan is\n completely addressed.\n\n Agency Response. AMS concurs with this recommendation. MNB will\n work with the newly establish Cyber Security Branch to ensure that the\n LMPRS security plan conforms to Federal and Departmental regulations,\n including appropriate waivers for noncompliant conditions. No later than\n May 31, 2005, MNB and the Cyber Security Branch will ensure that the\n LMPRS security plan is updated as appropriate. On December 13, 2004,\n AMS provided correspondence with the following clarification: Further, no\n later than September 2005, management controls will be established and\n implemented to ensure future security plans conform with Federal and\n Departmental regulations.\n\n OIG Position. We accept the AMS management decision for\n Recommendation No. 7. In our opinion, final action will be completed when\n AMS provides OCFO/PAD documentation of management controls to\n ensure that the LMPRS security plan conforms to Federal and Departmental\n regulations, including an updated LMPRS security plan.\n\nRecommendation No. 8\n\n Establish and implement management controls to ensure POA&M data is\n compiled and updated as required for LMPRS.\n\n Agency Response. AMS concurs with this recommendation. MNB and\n Cyber Security Branch staff will ensure a POA&M is completed for the\n LMPRS by January 31, 2005. On December 13, 2004, AMS provided\n correspondence with the following clarification: Further, no later than\n September 2005, management controls will be established to ensure that\n POA&M data will be routinely updated in the future.\n\x0c OIG Position. We accept the AMS management decision for\n Recommendation No. 8. In our opinion, final action will be completed when\n AMS provides OCFO/PAD documentation of a completed POA&M that\n includes LMPRS data.\n\nRecommendation No. 9\n\n Establish and implement management controls to ensure that the appropriate\n agency personnel are aware of Departmental requirements for information\n security, including security plans, POA&M data, and network scans.\n\n Agency Response. AMS concurs with this recommendation. AMS will\n supplement Departmental guidance with written agency directives regarding\n the use of system security plans, network patching and scanning, and\n POA&M reporting by September 2005.\n\n OIG Position. We accept the AMS management decision for\n Recommendation No. 9. In our opinion, final action will be completed when\n AMS provides OCFO/PAD documentation of the written agency directives\n for system security plans, network patching and scanning, and POA&M\n reporting.\n\nRecommendation No. 10\n\n Establish and implement management controls for the certification,\n accreditation, and periodic recertification of the LMPRS application.\n\n Agency Response. AMS concurs with this recommendation. The\n LMPRS application was certified and accredited on September 9, 2004.\n AMS will ensure that the LMPRS application is recertified as required by\n Federal and Departmental guidance. On December 13, 2004, AMS provided\n correspondence with the following clarification: Further, no later than\n September 2005, management controls will be established and implemented\n to ensure the LMPRS application will be recertified as required by Federal\n and Departmental guidance.\n\n OIG Position. We accept the AMS management decision for\n Recommendation No. 10. In our opinion, final action will be completed\n when AMS provides OCFO/PAD documentation that the LMPRS\n application has been certified and accredited.\n\nRecommendation No. 11\n\n Establish and implement management controls to perform monthly network\n scans of LMPRS and develop corrective action plans for critical\n vulnerabilities.\n\x0c Agency Response. AMS concurs with this recommendation. MNB\n began monthly scans of the LMPRS network during the OIG review. Any\n critical vulnerability that is identified is provided to the contractor for\n appropriate mitigation. Any corrective action taken (e.g., security patches)\n is documented in the system documentation. No later than May 31, 2005,\n the Trusted Facilities Manual will be modified to include the procedures for\n performing scans and addressing any corrective action required.\n\n OIG Position. We accept the AMS management decision for\n Recommendation No. 11. In our opinion, final action will be completed\n when AMS provides OCFO/PAD documentation of the written procedures\n for performing scans and addressing any corrective action required.\n\nRecommendation No. 12\n\n Establish and implement management controls to ensure contracts with\n service organizations include coverage of vulnerability identification and\n mitigation, such as router scans.\n\n Agency Response. AMS concurs with this recommendation. The only\n AMS service agreement that involves contractor support for vulnerability\n identification and mitigation is the LMPRS agreement. MNB will modify\n the LMPRS service agreement upon its renewal in September 2005 to\n specify vulnerability identification and mitigation services. On\n December 13, 2004, AMS provided correspondence with the following\n clarification: Further, no later than September 2005, management controls\n will be established and implemented to ensure that any future contracts will\n include coverage of vulnerability and mitigation.\n\n OIG Position. We accept the AMS management decision for\n Recommendation No. 12. In our opinion, final action will be completed\n when AMS provides OCFO/PAD documentation that the LMPRS contract\n has been modified to include vulnerability identification and mitigation\n services.\n\x0cGeneral Comments\n We determined that the operations of two of the four LMPRS contractors\n have had some level of review by a third party. Professional auditing\n standards28 state that when a user organization uses a service organization,\n transactions that affect the user organization\xe2\x80\x99s financial statements are\n subjected to controls that are, at least in part, physically and operationally\n separate from the user organization. Service organizations include bank\n trust departments that invest and service assets for employee benefit plans or\n for others, mortgage bankers that service mortgages for others, and\n application service providers that provide packaged software applications,\n and a technology environment that enables customers to process financial\n and operational transactions.\n\n External users of the LMPRS application rely on the data for financial\n decisions such as the purchase and sale of livestock. Therefore, we believe\n that it would be prudent for MNB to require reviews for the LMPRS\n contractors, which are conducted based on the above-mentioned professional\n auditing standards.\n\n\n\n\n28\n American Institute of Certified Public Accountants Professional Standards, AU Section 324: Service Organizations, as amended by applicable\nstatements on auditing standards\n\x0cScope and Methodology\n Our audit was part of a nationwide audit of selected USDA agencies. We\n selected AMS\xe2\x80\x99 LMPRS application from a listing submitted in November\n 2003 by USDA agencies of their major applications and general support\n systems needing to be certified and accredited by September 2004 to OCIO.\n The application was chosen based on it being mission critical and our\n knowledge of previous agency audits. The Livestock and Grain\n MNB Headquarters is in Washington, D.C., and the two field offices that\n handle mandatory information are in Des Moines, Iowa, and St. Joseph,\n Missouri. There are approximately 134 plants that submit mandatory data to\n the LMPRS application. We performed audit work at the AMS\n MNB located in Washington, D.C., and the AMS Des Moines Field Office\n in Des Moines, Iowa. We also visited the application contractor, who\n developed and maintains the application for AMS, and four judgmentally\n selected plants. We reviewed the AMS LMPRS activities for fiscal year\n 2004 and other years as necessary to develop the findings. We selected\n transactions made during the period from October 1 to October 24, 2003,\n comprised of data from 115 of the 134 plants. We selected 4 of the\n 115 plants to visit. Our fieldwork was performed during and for the period\n January 2004 thorough July 2004.\n\n To accomplish our audit objectives, we performed the following procedures:\n\n \xe2\x80\xa2 We interviewed responsible agency and contractor officials managing the\n application system, as well as both agency and plant users of the system.\n\n \xe2\x80\xa2 We reviewed, tested, and compared LMPRS application policies,\n procedures, handbooks, and administrative records to the requirements of\n Federal regulations, Departmental regulations, and other sources.\n\n \xe2\x80\xa2 We judgmentally selected 4 of 115 plants to examine controls over\n source documents and submission of LMPRS mandatory information.\n The plant selections were based on the method of data submission and\n proximity to the OIG Southwest Regional Office and the AMS\n Des Moines Field Office. The controls we examined included\n authorization, data terminal security, and accuracy of the data\n submissions. We verified a sample of transaction data submitted by each\n of the four plants.\n\n \xe2\x80\xa2 We performed Transmission Control Protocol/Internet Protocol\n vulnerability scans on various LMPRS network components.\n\x0cThis audit was conducted in accordance with generally accepted Government\nauditing standards. Therefore, the audit included tests of program and\naccounting records considered necessary to meet the audit objectives.\n\x0cExhibit A \xe2\x80\x93 Agency Response\n Exhibit A \xe2\x80\x93 Page 1 of 5\n\x0c\x0c\x0c\x0c\x0c"


text:
Karjaa () on entinen Suomen kaupunki. Karjaa sijaitsee Suomen etelärannikolla Uudellamaalla. Karjaa yhdistyi Pohjan ja Tammisaaren kanssa 1. tammikuuta 2009 Raaseporin kaupungiksi.
 Karjaan keskustaajamassa on 7 905 asukasta (31.12.2016).
 Historia
 Karjaalla sijaitsi nuoremmalla roomalaisajalla merkittävä asutuskeskittymä, josta kertovat seudulta löytyneet viisi ajanjakson kalmistoa. Karjaan alue on ollut alun perin varsinaissuomalaisten asuttamaa. Rautakauden lopulla asutusta oli ainakin kolmessa keskittymässä. Nykyisen Läppträskin alue on näistä vanhin muinaislinnoineen. Toinen rautakauden lopun asutusalue oli Karjaan pohjoisosassa Mustionjoen varsilla ja kolmas nykyisessä Snappertunassa Raaseporin linnan ympäristössä.
 Ruotsalaiset asuttivat alueen 1200–1300-lukujen aikana niin sanotun toisen ristiretken jälkeen. Ruotsalaissiirtolaiset kutsuivat alueen suomalaiskylää Finnbyksi. Alueelle tulleet ruotsalaiset asettuivat kylän lähistöllä oleville viljelyskelpoisille maille. Kylän nautinta-alue ulottui merelle, ruotsalaisten nimeämään Finneholmenin saareen asti. Saaren nimi on varhaisissa lähteissä kirjoitusasussa Veckasaar, joka lienee ollut saaren alkuperäinen suomenkielinen nimi. Karjaa näyttää ruotsalaistuneen täysin vuoden 1400 tienoilla. Siirtolaisten pääosa oli kotoisin Sveanmaalta, mutta heitä tuli myös Götanmaalta, Taalainmaalta, Gästriklandista ja myös Ahvenanmaalta.
 Karjaa mainitaan ensimmäisen kerran kirjallisissa lähteissä vuonna 1326, ja se oli keskiajan alussa Länsi-Uudenmaan keskusalue. Karjaan keskeisyydestä kertoo se, että sieltä käsin tehtiin koko maakunnan piispantarkastukset ja siellä asui myös Uudenmaan veronkantaja. Myöhemmin hallintokeskus muutti Karjaalta Raaseporin linnaan.
 Karjaan kaupunkiin kuului myös Mustio (ruots. Svartå), joka sijaitsee Karjaan keskustasta noin 14 km Lohjan suuntaan. Mustio on ollut Suomen toisen rautaruukin sijoituspaikka vuodesta 1560. Ruukin perusti Ruotsin kuninkaan Kustaa Vaasan vallan aikana Suomen herttua Juhana. Väitetään myös, että Suomen toisen auton olisi hankkinut Mustiolle kamariherra Hjalmar Linder 1900-luvun alussa. Vuonna 1873 avattu Hanko–Hyvinkää-rata ja vuonna 1899 avattu rautatieyhteys Turkuun synnyttivät Karjaalle asutustaajaman. Suora junayhteys Helsinkiin saatiin, kun säännöllinen rautatieliikenne Pasilan ja Karjaan välillä alkoi 1. syyskuuta 1903.
 Karjaan kirkonkylästä tuli taajaväkinen yhdyskunta vuonna 1910 ja kauppala vuonna 1930, ja samalla Karjaan kauppala erosi Karjaan maalaiskunnasta, johon Mustiokin kuului. Kauppala ja maalaiskunta yhdistyivät uudelleen 1. tammikuuta 1969. Vuonna 1977 Karjaa muuttui kauppalasta kaupungiksi.
 Ennen kaupungin lakkauttamista Karjaan kunnallisveroprosentti ehti olla Suomen korkein, 21 prosenttia. Kaupunki oli kaksikielinen ja enemmistö, 59 prosenttia asukkaista, puhui äidinkielenään ruotsia ja 38 prosenttia suomea. Karjaa kuului Uudenmaan vaalipiiriin ja sen kaupunginvaltuustossa oli 35 kaupunginvaltuutettua.
 Merkittäviä rakennuksia
 Karjaalle antavat leimansa arkkitehti Hilding Ekelundin suunnittelemat useat rakennukset ja kaavat sekä keskiaikainen kirkko.
 Kylät ja taajamat sekä kyliä kirkonkirjojen mukaan
 Backby, Backgränd, Bengtsmora, Björnbollstad, Bondby, Brasby, Bredvik, Brynikbacka, Bålaby, Båtsmora, Bällarby, Bällby, Degerby, Domargård, Dönsby, Finnbacka, Finnby, Grabbacka, Gösbacka, Heimos, Hållsnäs, Högben, Ingvallsby, Joddböle, Jällsby, Kansbacka, Karjaan asema (Karis station), Karjaan keskusta (Karis centrum), Kasabacka, Kasaby, Kaunislahti (Grundsjö), Kiila (Kila), Kleven, Knapsby, Konungsböle, Kroggård, Kudiby, Kurby, Kvarvbacka, Leppi (Läpp), Lågbacka, Lövkulla, Mangård, Meltola (Mjölbolsta), Mjölnarby, Mustio (Svartå), Nyby, Osmundsböle, Pappila (Prästgården), Päsarby, Reiböle, Romsarby, Sannäs, Sepänkylä (Smedsby), Snällböle, Starkom, Sutarkulla, Svarvarböle, Svedja, Torsböle, Visanbacka, Västanby, Österby
 Nähtävyyksiä
 Pyhän Katariinan kirkko
 Mustion kirkko
 Mustion linna
 Mustion ruukki
 Grabbackan linnan rauniot
 Junkarsborgin puulinnan rauniot
 Lepinjärvi (Läppträsket), lintujärvi
 Brobacka, Stora näset ja Lilla näset, muinaismuistoja
 Kroggårdsmalmenin rautakautinen kalmisto
 Grabben kanava
 Maasillan taistelun muistomerkki
 Liikenne
 Karjaalla on Bäljensin rautatietunneli. Karjaan rautatieasemalla pysähtyvät useimmat Helsingin ja Turun väliset junat. Sieltä kulkee myös taajamajunia Hankoon. Karjaan kautta kulkee valtatie 25, josta eroaa liittymä noin kolme kilometriä keskustasta kantatielle 51 Helsinkiin.
 Yrityksiä
 SBA-Interior Ab, Mustio, laivateollisuus (huonekalut, seinä- ja lattiaelementit) sekä laser- ja metallityöalihankinta. Suurin yksittäinen työnantaja Karjaan kaupungissa (2004)
 Oy Sisu Auto AB, Suomen ainoa kuorma-autotehdas.
 Urheiluseuroja
 Bollklubben-46 (BK-46), jalkapallo
 Karis Idrottsklubb (KIK), yleisurheilu
 HC Raseborg (Team Camise), käsipalloseura
 Bollklubben-46 (BK-46), käsipalloseura
 Floorball Club Elit (FBC Elit), salibandy
 Karjaan Ura, suunnistus ja shakki
 Ice Team Raseborg, jääurheilu
 Team Tamminen, pyöräily
 LUP-82 Länsiuudenmaan pyöräilijät 82, Pyöräily
 Ruokakulttuuri
 Karjaan pitäjäruoaksi nimettiin 1980-luvulla perunamakkara.
 Lähteet
 Viitteet
 Aiheesta muualla
 Seulonnan keskeiset artikkelit


text:
Øksnebjerg (også stavet Øxnebjerg) består af to bakketoppe, Store Øksnebjerg på 85 meter og Lille Øksnebjerg på 73 meter. Bakkerne ligger ca. seks kilometer øst for Assens, Fyn.
 Naturområdet på Øksnebjerg har en fin tilgængelighed og med udsigt over det omliggende morænelandskab og det sydfynske øhav.
 Bakkerne er kendt for Johan Rantzaus sejr over lübeckerne i 1535, hvorfor der også er rejst en mindesten på stedet.
 Eksterne henvisninger
 Lexopen
 Salmonsens Konversationsleksikon, 2 udgave, bind XXV, s. 818; opslag: Øksnebjerg
 Bakker i Danmark
 Assens Kommunes geografi


type: legislation

jurisdiction: EU

text:
 Svarbus teisinis pranešimas
 |
 52007PC0095
 Pasiūlymas Europos parlamento ir Tarybos reglamentas iš dalies keičiantis Reglamentą (EB) Nr. 1059/2003 dėl bendro teritorinių statistinių vienetų klasifikatoriaus (NUTS) nustatymo į Europos Sąjungą įstojus Bulgarijai ir Rumunijai /* KOM/2007/0095 galutinis - COD 2007/0038 */
 [pic] | EUROPOS BENDRIJŲ KOMISIJA |Briuselis, 13.3.2007KOM(2007) 95 galutinis2007/0038 (COD)PasiūlymasEUROPOS PARLAMENTO IR TARYBOS REGLAMENTASiš dalies keičiantis Reglamentą (EB) Nr. 1059/2003 dėl bendro teritorinių statistinių vienetų klasifikatoriaus (NUTS) nustatymo į Europos Sąjungą įstojus Bulgarijai ir Rumunijai(pateikta Komisijos)AIŠKINAMASIS MEMORANDUMASEuropos Parlamento ir Tarybos reglamentu (EB) Nr. 1059/2003 valstybėms narėms nustatytas bendras teritorinių statistinių vienetų klasifikatorius (vadinamas „NUTS“). Reglamentas iš dalies pakeistas dėl ES plėtros 2004 m. prisijungus 10 naujų valstybių narių, priėmus Europos Parlamento ir Tarybos pakeičiantį reglamentą (EB) Nr. 1888/2005.Į Europos Sąjungą įstojus Bulgarijai ir Rumunijai šioms valstybėms narėms siūlomu reglamentu nustatomas Bendrijos statistinių teritorinių vienetų klasifikatorius.2007/0038 (COD)PasiūlymasEUROPOS PARLAMENTO IR TARYBOS REGLAMENTASiš dalies keičiantis Reglamentą (EB) Nr. 1059/2003 dėl bendro teritorinių statistinių vienetų klasifikatoriaus (NUTS) nustatymo į Europos Sąjungą įstojus Bulgarijai ir RumunijaiEUROPOS PARLAMENTAS IR EUROPOS SĄJUNGOS TARYBA,atsižvelgdami į Europos bendrijos steigimo sutartį, ypač į jos 285 straipsnio 1 dalį,atsižvelgdami į Komisijos pasiūlymą,atsižvelgdami į Europos ekonomikos ir socialinių reikalų komiteto nuomonę[1],atsižvelgdami į Regionų komiteto nuomonę[2],laikydamiesi Sutarties 251 straipsnyje[3] nustatytos tvarkos,kadangi:1. Reglamentu (EB) Nr. 1059/2003[4] sukurta teisinė regionų klasifikavimo sistema, kad būtų galima Bendrijoje rinkti, rengti ir platinti suderintą regioninę statistiką.2. Visi Komisijai perduodami valstybių narių statistiniai duomenys, kurie yra suskirstyti pagal teritorinius vienetus, turėtų būti klasifikuojami pagal NUTS klasifikatorių, jei tinka.3. Būtina pakeisti Reglamento (EB) Nr. 1059/2003 priedus siekiant atsižvelgti į Bulgarijos ir Rumunijos įstojimą į Europos Sąjungą.4. Todėl reikėtų iš dalies pakeisti Reglamentą (EB) Nr. 1059/2003,PRIĖMĖ ŠĮ REGLAMENTĄ:1 straipsnisReglamentas (EB) Nr. 1059/2003 iš dalies keičiamas taip:1. I priedas iš dalies keičiamas pagal šio reglamento I priedo tekstą.2. II priedas iš dalies keičiamas pagal šio reglamento II priedo tekstą.3. III priedas iš dalies keičiamas pagal šio reglamento III priedo tekstą.2 straipsnisŠis reglamentas įsigalioja kitą dieną nuo jo paskelbimo Europos Sąjungos oficialiajame leidinyje .Šis reglamentas yra privalomas visas ir tiesiogiai taikomas visose valstybėse narėse.Priimta Briuselyje, [...]Europos Parlamento vardu Tarybos varduPirmininkas Pirmininkas[...] [...]I PRIEDASReglamento (EB) Nr. 1059/2003 I priedas iš dalies keičiamas taip:1. Tarp BE - BELGIQUE/BELGIË ir CZ - ČESKÁ REPUBLIKA įterpiama ši lentelė:“ БЪЛГАРИЯKODAS | NUTS 1 | NUTS 2 | NUTS 3 |BG |BG3 | СЕВЕРНА И ЮГОИЗТОЧНА БЪЛГАРИЯ |BG31 | Северозападен |BG311 | Видин |BG312 | Монтана |BG313 | Враца |BG314 | Плевен |BG315 | Ловеч |BG32 | Северен централен |BG321 | Велико Търново |BG322 | Габрово |BG323 | Русе |BG324 | Разград |BG325 | Силистра |BG33 | Североизточен |BG331 | Варна |BG332 | Добрич |BG333 | Шумен |BG334 | Търговище |BG34 | Югоизточен |BG341 | Бургас |BG342 | Сливен |BG343 | Ямбол |BG344 | Стара Загора |BG4 | ЮГОЗАПАДНА И ЮЖНА ЦЕНТРАЛНА БЪЛГАРИЯ |BG41 | Югозападен |BG411 | София (столица) |BG412 | София |BG413 | Благоевград |BG414 | Перник |BG415 | Кюстендил |BG42 | Южен централен |BG421 | Пловдив |BG422 | Хасково |BG423 | Пазарджик |BG424 | Смолян |BG425 | Кърджали |BGZ | EXTRA-REGIO |BGZZ | Extra-Regio |BGZZZ | Extra-Regio |”2. Tarp PT – PORTUGAL IR SI – SLOVENIJA įterpiama ši lentelė:“ ROMÂNIAKODAS | NUTS 1 | NUTS 2 | NUTS 3 |RO |RO1 | MACROREGIUNEA UNU |RO11 | Nord-Vest |RO111 | Bihor |RO112 | Bistriţa-Năsăud |RO113 | Cluj |RO114 | Maramureş |RO115 | Satu Mare |RO116 | Sălaj |RO12 | Centru |RO121 | Alba |RO122 | Braşov |RO123 | Covasna |RO124 | Harghita |RO125 | Mureş |RO126 | Sibiu |RO2 | MACROREGIUNEA DOI |RO21 | Nord-Est |RO211 | Bacău |RO212 | Botoşani |RO213 | Iaşi |RO214 | Neamţ |RO215 | Suceava |RO216 | Vaslui |RO22 | Sud-Est |RO221 | Brăila |RO222 | Buzău |RO223 | Constanţa |RO224 | Galaţi |RO225 | Tulcea |RO226 | Vrancea |RO3 | MACROREGIUNEA TREI |RO31 | Sud - Muntenia |RO311 | Argeş |RO312 | Călăraşi |RO313 | Dâmboviţa |RO314 | Giurgiu |RO315 | Ialomiţa |RO316 | Prahova |RO317 | Teleorman |RO32 | Bucureşti - Ilfov |RO321 | Bucureşti |RO322 | Ilfov |RO4 | MACROREGIUNEA PATRU |RO41 | Sud-Vest Oltenia |RO411 | Dolj |RO412 | Gorj |RO413 | Mehedinţi |RO414 | Olt |RO415 | Vâlcea |RO42 | Vest |RO421 | Arad |RO422 | Caraş-Severin |RO423 | Hunedoara |RO424 | Timiş |ROZ | EXTRA-REGIO |ROZZ | Extra-Regio |ROZZZ | Extra-Regio |”II PRIEDASReglamento (EB) Nr. 1059/2003 II priedas iš dalies keičiamas taip:1. Tarp Belgijos ir Čekijos Respublikos su NUTS 3 lygmeniu susijusioje dalyje įterpiama:„Bulgarijos ‘Области (Oblasti)’,“2. Tarp Vengrijos ir Slovakijos Respublikos su NUTS 3 lygiu susijusioje dalyje įterpiama:„Rumunijos ‘Judeţe’, “III PRIEDASReglamento (EB) Nr. 1059/2003 III priedas iš dalies keičiamas taip:1. Tarp Belgijos ir Čekijos Respublikos įterpiama:„Bulgarijos ‘Населени места (Naseleni mesta)’, “2. Tarp Portugalijos ir Slovėnijos įterpiama:„Rumunijos ‘Municipii, Oraşe, Comune’,“[1] OL C [...], [...], p. [...].[2] OL C , , p. .[3] OL C [...], [...], p. [...].[4] OL L 154, 2003 6 21, p. 1. Reglamentas su pakeitimais, padarytais Europos Parlamento ir Tarybos reglamentu (EB) Nr. 1888/2005 (OL L 309, 2005 11 25, p. 1).


text:
Das spanische Verfassungsgericht () steht außerhalb der Hierarchie der spanischen Fachgerichte und entscheidet spezifisch über die Frage der Vereinbarkeit von Akten der öffentlichen Gewalt mit den Vorgaben der spanischen Verfassung. Mit diesem Auftrag geht die ausschließlich dem Verfassungsgericht zustehende Kompetenz einher, Gesetze im formellen Sinn als verfassungswidrig zu verwerfen und für nichtig zu erklären. Die Entscheidungen des Verfassungsgerichts haben Gesetzeskraft und werden im spanischen Gesetzesblatt, dem Boletín Oficial del Estado (BOE), veröffentlicht.
 Die einer Entscheidung durch das Verfassungsgericht zugänglichen Rechtsfragen sind in dem Zuständigkeitskatalog des Organgesetzes (Ley Orgánica 2/1979, de 3 de octubre, del Tribunal Constitucional; abgekürzt: LOTC), das zugleich den rechtlichen Rahmen für die Organisation und Tätigkeit des Verfassungsgerichts setzt, aufgeführt (siehe hierzu IV.). Zuletzt wurde das spanische Verfassungsgerichtsgesetz mit Organgesetz vom 24. Mai 2007 geändert (Ley Orgánica 6/2007). Seinen Sitz hat das spanische Verfassungsgericht in Madrid.
 Allgemeines
 Der spanische Oberste Gerichtshof (Tribunal Supremo) steht an der Spitze der spanischen Fachgerichtsbarkeit und entscheidet letztinstanzlich in allen Verfahren. Die Entscheidungen des Obersten Gerichtshofes können nur durch das spanische Verfassungsgericht im Rahmen einer der gesetzlich bestimmten Verfahrensarten aufgrund der Verletzung spezifischen Verfassungsrechts für unwirksam erklärt werden. Die Unterschiede zwischen Verfassungsgericht und Oberstem Gerichtshof sind damit nicht hierarchischer, sondern kompetenzrechtlicher Natur.
 Mit der Änderung des Verfassungsgerichtsgesetzes vom 24. Mai 2007 ist das Verfassungsgericht angesichts der mitunter umstrittenen Kompetenzverteilung insbesondere im Verhältnis zum Obersten Gerichtshof insoweit gestärkt worden, als ausschließlich das Verfassungsgericht über seine Gerichtsbarkeit im Rahmen des Zuständigkeitskataloges befindet und die vom Verfassungsgericht einmal angenommene Zuständigkeit durch kein anderes Gericht beansprucht werden kann.
 Zur Vermeidung von Konflikten infolge der Zuständigkeit des Obersten Gerichtshofes für zivilrechtliche Haftungsfragen im Zusammenhang mit Amtshandlungen der Richter des Verfassungsgerichts sollte letzteren durch eine Gesetzesinitiative aus dem Jahr 2005 Immunität gewährt werden. Hintergrund war die Verurteilung von Richtern des Verfassungsgerichts zu Schadensersatzzahlungen durch den Obersten Gerichtshof. Die Initiative wurde jedoch nicht umgesetzt; lediglich einzelne, schon 2005 vorgeschlagene Neuregelungen sind nunmehr mit dem oben genannten Änderungsgesetz vom 24. Mai 2007 in Kraft getreten.
 Zusammensetzung
 Wahlverfahren und Amtszeit
 Das spanische Verfassungsgericht besteht aus zwölf Mitgliedern, den Magistrados. Diese werden per Dekret (Real Decreto) vom spanischen König ernannt. Die Ernennung von jeweils vier Richtern erfolgt auf Vorschlag der beiden Kammern der Cortes Generales (Kongress und Senat). Jeweils zwei weitere Richter werden durch die Regierung und dem „Generalrat der rechtsprechenden Gewalt“ (Consejo General del Poder Judicial) vorgeschlagen. Bei der Abstimmung in den Cortes Generales muss sich eine qualifizierte Mehrheit von drei Fünfteln der Mitglieder der jeweiligen Kammer für einen Kandidaten aussprechen.
 Die Ernennung der Richter erfolgt für einen Zeitraum von neun Jahren. Alle drei Jahre wird ein Drittel der Richter nach Ablauf ihrer Amtszeit durch neue Richter ersetzt. Persönliche Voraussetzung für die Berufung zum Verfassungsgericht ist neben der spanischen Staatsangehörigkeit die durch mehr als 15 Jahre Berufserfahrung belegte und allgemein anerkannte Kompetenz des zur Wahl stehenden Juristen. Dieser kann beispielsweise als Staatsanwalt, Richter, Universitätsprofessor, Beamter im öffentlichen Dienst oder als Rechtsanwalt tätig sein.
 Die dem Verfassungsgericht angehörenden Richter sind unabhängig und unabsetzbar. Während ihrer Amtszeit ist es ihnen untersagt, politische Ämter, Mandate oder leitende Funktionen in einer Partei oder Gewerkschaft zu übernehmen sowie eine andere berufliche Tätigkeit auszuüben.
 In der öffentlichen Wahrnehmung werden die Mitglieder des Verfassungsgerichts entweder dem progressiven (d. h. PSOE-nahen) oder dem konservativen (PP-nahen) Lager zugeordnet. Da für die Besetzung der vom Kongress bzw. dem Senat zu besetzenden Richterstellen eine 3/5-Mehrheit notwendig ist, ergibt sich insoweit de facto die Notwendigkeit einer Einigung zwischen den beiden großen Parteien (PSOE und PP).
 In den Jahren 2007 bis 2012 kam es zu einer Blockade bei der Neubesetzung der Richterposten, da sich die beiden großen Parteien nicht verständigen konnten. Für die eigentlich Ende 2007 vom Senat zu besetzenden vier Richterposten kam es erst Ende 2010 zu einer Einigung, also mit einer Verspätung von drei Jahren. Die eigentlich Ende 2010 zur Neubesetzung durch den Kongress anstehenden vier Richterposten wurden aufgrund derselben Probleme erst Mitte 2012 neu besetzt, also mit einer Verspätung von eineinhalb Jahren. In der Zwischenzeit blieben die bisherigen Richter weiter im Amt.
 Durch diese Blockade bei der eigentlich längst fälligen Neubesetzung geriet das Gericht in eine tiefe institutionelle Krise, die auch die öffentliche Akzeptanz seiner Entscheidungen berührte. So wurde etwa in der Kritik am Urteil des Gerichts vom 28. Juni 2010 zum Autonomiestatut von Katalonien häufig angeführt, dass dieses von einem Verfassungsgericht in nicht regulärer Besetzung gefällt worden sei.
 Zur letzten Neubesetzung kam es im Juni 2013, diesmal ohne Verspätung. Dieses Mal betraf es die zwei von der Regierung und die zwei vom Consejo General del Poder Judicial zu besetzenden Richterstellen. Seitdem besteht eine 7:5-Mehrheit des konservativen Lagers:
 Organisation
 Der Sitz des Verfassungsgerichts ist Madrid. Die zwölf Richter des Gerichts bilden das so genannte Plenum (pleno), welches sich in zwei Senaten (salas) zu jeweils sechs Richtern teilt. In weiteren Untergliederungen, den so genannten Abteilungen (secciones), entscheiden jeweils drei Richter über die Zulässigkeit und damit die Annahme von Anträgen zur Entscheidung durch das Verfassungsgericht. Mit Ausnahme der Verfassungsbeschwerden, die ausschließlich der Senat behandelt, entscheidet das Verfassungsgericht stets in der Besetzung des Plenums.
 Das Plenum wählt in geheimer Wahl aus seinen Reihen einen Präsidenten, der daraufhin dem König zur Ernennung vorgeschlagen wird. Die Amtszeit des Präsidenten beträgt drei Jahre. Nach diesem Verfahren vollzieht sich auch die Ernennung des Vizepräsidenten. Präsident und Vizepräsident übernehmen jeweils den Vorsitz des ersten und zweiten Senats des Verfassungsgerichts.
 Die bisherige Übung, nach der sich die Amtszeit des Präsidenten bis zum Ablauf seiner Angehörigkeit zum Verfassungsgericht als Richter verlängerte, wurde mit dem oben genannten Änderungsgesetz vom 24. Mai 2007 nunmehr gesetzlich festgeschrieben.
 Zuständigkeit
 Folgende Verfahrensarten bzw. Rechtsfragen sind dem Verfassungsgericht zur Entscheidung zugewiesen:
 Abstrakte und konkrete Normenkontrolle
 Prüfungsgegenstand können dabei sowohl Gesetze im formellen als auch im materiellen Sinn (so z. B. decretos-leyes und decretos legislativos) sein, während Rechtssetzungsakte der Exekutive (z. B. reglamentos) der Prüfungs- und Verwerfungskompetenz der Fachgerichte unterliegen. Stellt das Gericht die Verfassungswidrigkeit und damit die Nichtigkeit einer Norm fest, so erstreckt sich die Nichtigkeitsfolge lediglich auf die betreffende Vorschrift, wenn das Gesetz im Übrigen einer Anwendung zugänglich bleibt. Der Normenkontrolle unterliegen als Organgesetze auch die Statuten der autonomen Regionen Spaniens.
 Verfassungsbeschwerde (Recurso de amparo)
 Prüfungsgegenstand ist ein Akt der öffentlichen Gewalt, durch den ein Grundrechtsträger behauptet, in seinen verfassungsmäßig garantierten Rechten verletzt zu sein. Voraussetzung für die Anrufung des Verfassungsgerichts ist die Erschöpfung des Rechtswegs. Angesichts der hohen Zahl von (zumeist unzulässigen) Verfassungsbeschwerden sind mit der Änderung des Verfassungsgerichtsgesetzes vom 24. Mai 2007 die Anforderungen an die Darlegung und Begründung einer Verfassungsbeschwerde erhöht worden. Auch die Grundsätze der Rechtswegerschöpfung und der Subsidiarität der Verfassungsbeschwerde sind deutlicher als in der bisher geltenden Fassung des Verfassungsgerichtsgesetzes hervorgehoben.
 Kompetenzstreitigkeiten zwischen Staat und autonomen Regionen
 Besteht zwischen dem spanischen Staat (Estado) und den autonomen Regionen (Comunidades Autónomas) oder aber zwischen letzteren ein Streit über die der jeweiligen Gebietskörperschaft zugewiesenen Kompetenzen und deren Ausübung, so können der Staat oder die betroffenen Regionen das Verfassungsgericht anrufen.
 Organstreitverfahren
 Das Verfassungsgericht entscheidet über Streitigkeiten zwischen Verfassungsorganen hinsichtlich der sie betreffenden Rechte. Sieht ein Verfassungsorgan sich in seinen verfassungsmäßig vorgesehenen Rechten durch einen Akt eines anderen Organs verletzt oder hierin einen unzulässigen Eingriff in die dem Organ zugewiesenen Kompetenzen, so kann es die Klärung der Frage durch das Verfassungsgericht beantragen.
 Kommunalverfassungsbeschwerde
 In diesem Verfahren können die Kommunen Eingriffe in die ihnen zugewiesenen Rechte, namentlich auf dem Gebiet der Selbstverwaltung, durch den Staat oder die autonomen Regionen abwehren.
 Internationale Verträge
 Vor dem Inkrafttreten und damit der Erlangung von Gesetzesrang können internationale Verträge bei Zweifeln hinsichtlich ihrer Vereinbarkeit mit spanischen Verfassungsrecht dem Verfassungsgericht zur Prüfung vorgelegt werden.
 Ernennung der Mitglieder
 Das Verfassungsgericht entscheidet über die Rechtmäßigkeit der Ernennung der dem Gericht angehörenden Richter.
 Weitere Entscheidungskompetenzen sind bzw. können dem Verfassungsgericht durch Organgesetze (Leyes Orgánicas) zugewiesen werden. Der Ausspruch eines Parteiverbots ist im Gegensatz zur deutschen Zuständigkeitsregelung dem spanischen Obersten Gerichtshof vorbehalten.
 Zitierweise der Entscheidungen
 Urteile werden mit STC (Sentencia del Tribunal Constitucional) abgekürzt, Beschlüsse mit ATC (Auto del Tribunal Constitucional). Es folgt die laufende Nummer der jeweiligen Entscheidung in dem Kalenderjahr. Mit „STC 103/2008“ z. B. ist also das 103. Urteil aus dem Jahr 2008 gemeint. Die Urteile gliedern sich in eine Sachverhaltsdarstellung (antecedentes) und die Entscheidungsgründe (fundamentos jurídicos, abgekürzt FJ), auf die abschließend der Tenor (fallo) folgt. Mit der Angabe „STC 103/2008, FJ 4“ z. B. wird auf Punkt 4 der Entscheidungsgründe des Urteils 103/2008 Bezug genommen.
 Die Entscheidungen sind sämtlich auf der Internetseite des Gerichts abrufbar.
 Literatur
 Francisco Rubio Llorente: Die Verfassungsgerichtsbarkeit in Spanien. In: Christian Starck, Albrecht Weber (Hrsg.): Verfassungsgerichtsbarkeit in Westeuropa. Teilband I. 2. Auflage. Nomos, Baden-Baden 2007, ISBN 978-3-8329-2640-3 (Studien und Materialien zur Verfassungsgerichtsbarkeit. Band 30/I), S. 165–198.
 Siehe auch
 Verfassungsgerichtsbarkeit
 Weblinks
 Offizielle Webseite des Spanischen Verfassungsgerichtes (spanisch/englisch)
 Einzelnachweise
 Verfassungsgericht
 Spanien
 Politik (Spanien)
 Organisation (Madrid)
 Gegründet 1978


text:
 Avis juridique important
 |
 51999PC0063
 Proposta de Regulamento (CE) do Conselho que altera o Regulamento (CE) no 2597/97 do Conselho que estabelece as regras complementares da organização comum de mercado no sector do leite e dos produtos lácteos no que diz respeito ao leite de consumo /* COM/99/0063 final - CNS 99/0048 */
 Jornal Oficial no C 070 de 13/03/1999 p. 0014
 Proposta de REGULAMENTO (CE) DO CONSELHO que altera o Regulamento (CE) no 2597/97 do Conselho que estabelece as regras complementares da organização comum de mercado no sector do leite e dos produtos lácteos no que diz respeito ao leite de consumo(apresentada pela Comissão)EXPOSIÇÃO DE MOTIVOSO artigo 4o do Regulamento (CE) n 2597/97 prevê certos requisitos no que respeita à composição do leite de consumo, aplicáveis a partir de 1 de Janeiro de 1999. A alínea d) do referido artigo especifica, nomeadamente, que o leite inteiro deve ter um teor de matéria seca e isenta de gordura superior ou igual a 8,50 % (m/m).Nos debates que precederam a adopção deste regulamento, certos Estados-Membros evocaram as dificuldades que esse requisito poderia acarretar, tendo em conta o teor de resíduo seco isento de matéria gorda constatado no leite cru produzido nos respectivos territórios. Em resposta, a Comissão comprometeu-se a analisar esse requisito, a pedido de um Estado-Membro, tendo em conta estudos científicos e estatísticos.Neste contexto, dois Estados-Membros apresentaram um processo à Comissão que indica que o leite cru produzido no seu território não atingiu o teor mínimo de resíduo seco isento de matéria gorda previsto no Regulamento (CE) n 2597/97, durante toda ou parte do ano. Essa situação poderá acarretar consequências graves para a produção de leite de consumo nestes países e colocar mesmo em risco o seu abastecimento em leite de consumo. É, portanto, oportuno ponderar a alteração ou supressão da disposição do regulamento em causa.A este propósito, importa recordar antes do mais que as disposições do artigo 4o do Regulamento (CE) n 2597/97 relativas à composição do leite de consumo foram retomadas da Directiva 92/46/CEE que adopta as normas sanitárias relativas à produção e colocação no mercado de produtos à base de leite. Justificaram-se pela necessidade de garantir uma qualidade mínima no que respeita à composição do leite de consumo. Por uma questão de coerência, considerou-se desejável incluir estas disposições na regulamentação relativa às normas de comercialização do leite de consumo.Além disso, importa sublinhar que, no que respeita à composição do leite de consumo, o objectivo primário do Regulamento (CE) n 2597/97 é evitar qualquer manipulação não autorizada do leite cru. A fixação de critérios mínimos - que reflectem necessariamente os valores mínimos do leite cru constatados na Comunidade - não pode ser considerada um factor de segurança. Assim, no que respeita ao ponto de congelação, o requisito quantitativo constante da Directiva 92/46/CEE foi substituído por um controlo comparativo dos pontos de congelação do leite cru e do leite de consumo. A Comissão considera igualmente que o controlo da proibição de manipulação do teor de proteínas do leite cru deve merecer particular atenção .Nestas condições, a Comissão considera que, sem que fosse comprometida a qualidade deste produto, poderia ser suprimida a disposição relativa ao teor mínimo de resíduo seco isento de matéria gorda do leite de consumo. Em contrapartida, ela zelará por que os Estados-Membros procurem evitar qualquer manipulação não autorizada do leite cru utilizado no fabrico do leite de consumo. A proposta de regulamento em anexo prevê, portanto, a supressão da alínea d) do artigo 4o do Regulamento (CE) n 2597/97.Proposta deREGULAMENTO (CE) DO CONSELHOque altera o Regulamento (CE) no 2597/97 que estabelece as regras complementares da organização comum de mercado no sector do leite e dos produtos lácteos no que diz respeito ao leite de consumoO CONSELHO DA UNIÃO EUROPEIA,Tendo em conta o Tratado que institui a Comunidade Europeia, e, nomeadamente, o seu artigo 43o,Tendo em conta a proposta da Comissão (1),(1) JO C duTendo em conta o parecer do Parlamento Europeu (2),(2) JO C duConsiderando que a alínea d) do artigo 4o do Regulamento (CE) n 2597/97 do Conselho, de 18 de Dezembro de 1997 (3), estabelece que o leite de consumo deve ter um teor de resíduo seco isento de matéria gorda igual ou superior a 8,50% (m/m) no caso de leite com 3,50% (m/m) de matéria gorda, ou uma percentagem equivalente, no caso de leite com um teor de matéria gorda diferente; que foi constatado que o leite cru recolhido em certos Estados-Membros não atinge o referido teor durante toda ou parte do ano; que essa situação pode prejudicar o abastecimento regular de leite de consumo a certas regiões da Comunidade; que, tendo em conta as restrições previstas no no 2 do artigo 3o, relativas à manipulação da parte seca e isenta de matéria gorda do leite, bem como os outros requisitos complementares previstos no artigo 4o, é oportuno suprimir a alínea d) acima referida, com efeitos a partir da sua entrada em vigor,(3) JO L 351 du 23.12.1997, p.13.ADOPTOU O PRESENTE REGULAMENTO:Artigo 1 No artigo 4o do Regulamento (CE) n 2597/97, é suprimida a alínea d).Artigo 2 O presente regulamento entra em vigor no terceiro dia seguinte ao da sua publicação no Jornal Oficial das Comunidades Europeias.O presente regulamento é aplicável a partir de 1 de Janeiro de 1999.O presente regulamento é obrigatorio em todos os seus elementos e directamente aplicàvel em todos os Estados-membros.Feito em Bruxelas, em Pelo Conselho O Presidente>POSIÇÃO NUMA TABELA>