Fiscal Year 2017 Federal Information Security Modernization Act Evaluation
CNCS has devoted significant resources to improving cybersecurity over the past few years, with meaningful progress. Although its information security program is not yet sufficiently mature, it can reach effectiveness with continued effort and investment.Achieving effectiveness will require attention to weaknesses that pose significant risks to information security. Our 2017 evaluation found inadequacies in risk management, configuration management, identity and access management, information security continuous monitoring, and contingency planning.