Cybersecurity Policy Report, OIG REPORTS: External audit reveals HHS not in compliance with federal information security requirements, (Apr 3, 2026)

By Leah S. Poniatowski, J.D.

Agency’s security program tallies sixth year in a row as being “not effective.

HHS’s Office of the Inspector General (OIG) reported that the agency’s information security program was deemed “not effective” by the outside auditor in its annual review, thus marking the sixth year of falling below the target maturity model level. The OIG offered ten recommendations, and maintained the validity of those despite HHS disagreement over three(OIG Report, OAS-25-18-041 (Mar. 25, 2026)).

Background. The Federal Information Security Modernization Act of 2014 (FISMA), amended on December 18, 2014 (Public Law 113-283), mandates annual review by an independent auditor of federal agency information security programs and practices in order to assess the effectiveness of those programs. FISMA, as amended, authorizes the Office of Management and Budget with oversight authority.

In accordance with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0 function areas, the annual audit reviews the six cybersecurity framework function areas, which are composed of ten domains. The IG FISMA Reporting Metrics were developed in collaboration by several federal agency representatives. The metrics are based on the maturity model approach.

The core metrics represent the administration priorities, high impact security processes, and the essential functions necessary to determine the effectiveness of the security program. The supplemental metrics represent important activities that contribute to the overall effectiveness of the security program.

Findings. The overall assessment of HHS’s information security program was “Not Effective.” None of the six function areas met the “Managed and Measurable” maturity level, the fourth of the five maturity model levels. The predominate scores of the ten domains were either “Ad Hoc” (level 1) or “Defined” (level 2), but none rose higher than “Consistently Implemented’ (level 3).

Under the “Governance” function area, the “Cybersecurity Governance” and “Cybersecurity Supply Chain Risk Management” domains were evaluated as “Ad Hoc” and “Defined,” respectfully. The “Ad Hoc” score reflected findings that several divisions had not defined processes and procedures to develop and maintain cybersecurity profiles, nor had cybersecurity profile requirements been defined by HHS policy. Additionally, two divisions had not defined risk management strategies or stayed current with risk management, among other shortcomings. The “Defined” score reflected that four divisions had not fully implemented supply chain risk management policies and procedures.

Under the “Identify” function area, the “Risk and Asset Management” domain was evaluated as the “Defined” level. The evaluation revealed that one of the divisions failed to accurately maintain inventories of systems and applications, hardware, and software, and that four of the divisions did not accurately maintain data inventory. Additionally, two divisions had not implemented the tool to help HHS manage cybersecurity risks.

Under the “Protect” function, the “Configuration Management,” “Identity and Access Management,” and “Security Training” domains were at the “Defined” level while the “Data Protection and Privacy” domain was “Consistently Implemented.” The shortcomings of these divisions included lacking secure configurations, inconsistent implementation for flaw remediation, improper management of privileged accounts, no skill gap evaluation of workforce, among others.

Under “Detect,” the sole information security continuous monitoring (ISCM) function was “Consistently Implemented,” falling short based on one of the divisions not consistently implementing the ISCM strategies and policies, logging requirements, or deploying an ISCM monitoring tool in its environment.

Under the “Respond” function, the “Incident Response” function also was deemed “Consistently Implemented.” Because one division had not implemented the event logging requirements, this function was assessed “Not Effective.”

Under the “Recover” function, the “Contingency Planning” domain only achieved a “Consistently Implemented” score based on the lack of business impact analyses at the HHS level and the lack of ensuring that all divisions were maintaining those analyses, in addition to one division not having conducted a business impact analysis at its level.

Recommendations. The OIG offered ten recommendations to HHS in order to improve its security program, but HHS’ Office of the Chief Information Officer (OCIO) did not concur with three of the recommendations. The OCIO disagreed that its policy to define cybersecurity roles and responsibilities and a process to evaluate them were outdated. The OIG explained that the policy failures, in addition to not being in compliance with HHS’s three-year review policy, correlate to several other issues throughout the organization.

The OCIO did not agree with the recommendation vis-a-vis privileged user access. The OIG explained that its recommendation was meant to improve the OCIO’s oversight responsibilities, particularly as HHS management acknowledged the challenges of event logging and monitoring of privileged user activity.

Finally, the OCIO did not agree with the last recommendation that it enforce policies and develop procedures for conducting and updating business impact analyses and require implementation at the department and division level. The OCIO stated that the responsibility for managing these analyses was with each operating division under HHS’s federated operating model. The OIG clarified that the department’s oversight responsibility included confirming that HHS policies for conducting these analyses be implemented. Because they had not been conducted despite there being a policy, the OIG maintained that its recommendation was valid.

ReportsLetters: OIGReports AuditNews CyberPrivacyFeed DataPrivacy DataSecurity