Lowest Possible Score for TSP Security Audit

by | Mar 5, 2018

Last Updated November 8, 2022

audit

The agency that administers the Thrift Savings Plan, the Federal Retirement Thrift Investment Board, received the lowest of 5 possible scores on a recent audit to determine its compliance with federal information security standards.

The consulting firm, Williams Adley, sent auditors who examined the information security program at the FRTIB under the Federal Information Security Modernization Act. The agency scored a Level 1 in accordance with the law’s fiscal 2017 inspector general reporting metrics out of 5, in the first annual study of FRTIB’s policies.

Auditors found some of the IT policies “ad hoc” in nature, despite FRTIB starting several initiatives to upgrade its IT infrastructure and cyber security recently. In comparison, an effective information security program scored at Level 4, which includes the collection of “quantitative and qualitative measures on the effectiveness of policies, procedures, and strategy” at an agency and assessment for needed changes.

“FRTIB has not fully developed and implemented an effective organization-wide information security program,” the auditors said. “Williams Adley identified a number of control deficiencies related to people, process, and technology across all 7 IG FISMA metric domains.”

However, officials at FRTIB explained their poor scoring. For a policy to be considered toward improving an agency’s FISMA score, it must be in place for an entire fiscal year. Otherwise, any changes to their information security policies made after September 30, 2016, wouldn’t be considered in the audit.

TSP Executive Director Ravindra Deo echoed this saying, “Any change needs to be operating for the entire year to show up in the score.”

Auditors listed many factors leading to the “ad hoc” scoring, including a “control-driven” or reactionary information security process, inadequately defined responsibilities and “inappropriate” oversight between FRTIB and its contractors, and efforts that focus on symptoms or problems, rather than root causes.

The audit recommended FRTIB “clearly define an organization-wide risk-based information security program” and also reevaluate its governance structure to ensure better oversight and monitoring of information security issues.

The agency said they are moving forward with plans to implement these recommendations.

Message us & find out if you qualify today!

  • This field is for validation purposes and should be left unchanged.

Recent Articles

Resources for Transitioning from Active Work to Disability Retirement

Leaving a job isn’t just about packing up a desk and closing a chapter—it’s about stepping away from a piece of who you are. For federal employees, the transition from active work to Federal Disability Retirement can feel like losing a part of your identity. It’s...

5 Keys to Budgeting After Federal Disability Retirement

Opening a letter from the OPM and seeing the words, “Your Federal Disability Retirement application has been approved” is a life-changing moment. You’ve been waiting for months and now that you’ve been approved, it’s time to start preparing for your new future. But...

The 5 Best Federal Disability Retirement Application Tips in 2024

Navigating life with a persistent injury or illness is challenging enough. When your job adds to that struggle, it can feel overwhelming. But what if there was a path that could offer you relief and a fresh start? Federal Disability Retirement might be the solution...

Federal Employee Resources

Our ever growing library of federal employee resources give you the knowledge you need to make smart choices about your future.

FAQs

Frequently Asked Questions

Get the answers you need on-demand, from a team of federal employee benefits professionals.

View FAQ
Webinars

Federal Benefit Webinars

Twice per month we host webinars to help federal employees better understand their benefits and answer their questions LIVE.

See Webinar Schedule
Guides

Benefit Guides

From guides to detailed charts, these educational resources will help clarify confusing federal employee benefits topics.

See our resources