Information Technology Security Systems Assessment
The purpose of this project was to conduct a program evaluation of the Information Technology (IT) security systems of the Federal Motor Carriers Safety Administration (FMCSA). The specific objectives were to:
Determine if key information system security practices complied with Federal and Agency information security requirements, e.g.:
Certification and accreditations were current
Contingency plans or testing of plans were in place and functional
Physical and environmental security controls were implemented
Procedures were in place for adequate asset accountability
Processes were in place to monitor servers for security vulnerabilities
Determine if appropriate network access controls are in place and the FMCSA IT system software employs the appropriate system protections to defend against worms, viruses, malicious-ware and other harmful vulnerabilities.
Determine if FMCSA IT systems are operating consistently with prevailing industry best practices and determine if FMCSA can benefit from implementing best practices derived from external entities. Identify costs/benefits of operating/system alternatives which might improve the security and further protect the system
Assess the adequacy of security related performance goals and provide recommendations in cases where goals and metrics are absent or deficient
TDG employed a team of SMEs from various disciplines to meet the requirement from FMCSA. We used NIST’s PRISMA program evaluation tool and our internal copyrighted System Security Scorecard (S-3) tool to evaluate at the system level. Both tools and the overarching process provided FMCSA with an actionable set of metrics for continuous monitoring and control the security program.
