Call us now:
It feels like cyber audits are coming thick and fast.
A very comprehensive audit by the Department of Justice(DoJ) Inspector General that evaluated the DoJ Cybersecurity-Supply Chain Risk Management Compliance (C-SCRM), through the Justice Management Division(JMD) and FBI, and their implementation of C-
SCRM procurement polices and procedures for products and services.
The report highlights a lack of compliance to C-SCRM by the Justice Management Department, that increased the risk of ‘introducing products or services into DOJs IT estate that could compromise the integrity of its systems and data’. Failing to implement C-SCRM programs and meet the expectations of its policies. Page 14 detailed the departments that are compliant with C-SCRM requirements. ‘There was no systemic process to identify purchases subject to C-SCRM’.
The impact of this is the DoJ, JMD and the FBI purchased products and services without carrying out the necessary cybersecurity due diligence. The report documented the widespread departmental non-compliance with C-SCRM and a failure to provide continued oversight and assurance of venders throughout the procurement lifecycle.
Purchasing and maintaining products and services that could be vulnerable to cybersecurity threats. Exposing the DoJ to threat actors that could access the most sensitive of data or compromise the DoJ at a time when they seek to set out a program of work to hold organisations to account for their cyber security compliance.
Ted Dziekanowski
#cybersecurity #departmentofjustice #fbi #cscrm
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6951810308172615680