«£D Sfyv \ U.S. Environmental Protection Agency 16-P-0254 * \ Dffirp nf In^nprtor npn^rpl August 1 20I6 % <¦"> PRO"*fc • U • w> tl I VII Vl llllvl lldl rl wlvvll Office of Inspector General \Sz? J At a Glance Why We Did This Review We performed this audit to assess to what extent the U.S. Chemical Safety and Hazard Investigation Board (CSB) implemented information system security policies and procedures to protect CSB systems that provide access to national security or Personally Identifiable Information (Pil) as outlined in Section 406 of the Cybersecurity Act of 2015. This report addresses the following CSB goal: • Preserve the public trust by maintaining and improving organizational excellence. Cybersecurity Act of 2015 Report: CSB's Policies and Procedures to Protect Systems With Personally Identifiable Information What We Found Section 406 of the Cybersecurity Act of 2015 calls for Inspectors General of agencies with covered systems to report on several aspects of the covered systems' information system security controls. The term "covered system" means a national security system as defined in 40 U.S.C. § 11103 or a federal computer system that provides access to Pll. CSB has one system that contains sensitive Pll. Safeguarding such information in the possession of the government and preventing its breach is essential to ensuring CSB retains the trust of the American public. CSB identified one covered system that contains sensitive Pll covered by provisions of the act. CSB does not have any national security information systems. The act requires Inspectors General to report on the areas identified in the bullets below. We provided information in the following eight areas based on the requirements outlined in the act for CSB's covered system: • Description of logical access policies and practices. • Description of the logical access controls and multi-factor authentication used to govern privileged users access. • Reasons for not using logical access controls and multi-factor authentication if applicable. • Policies and procedures used to conduct inventories of software and licenses. • Capabilities utilized to monitor and detect exfiltration and other threats. • Description of how monitoring and detecting capabilities are utilized. • Reasons why monitoring and detecting capabilities are not used if applicable. • Description of policies and procedures used to ensure entities and contractors providing services to CSB are implementing the information security management practices identified in the act. We worked closely with CSB throughout this audit to obtain the data in this Send all inquiries to our public report. We issued a draft report containing our conclusions, and subsequently affairs office at (202) 566-2391 briefed CSB representatives on the audit results. CSB agreed with our results, or visit www.epa.aov/oia. and did not provide a written response to this report. Listing of PIG reports. The full version of this report contained controlled unclassified information. This is a redacted version of that report, which means the controlled unclassified information has been removed. The redactions are clearly identified in the report. ------- |