Broadcasting Board of Governors lacks cyber reporting system, IG says

The State Department's Office of Inspector General has criticized the Broadcasting Board of Governors' IT incident response and reporting program for "not operating effectively" in compliance with federal standards, according to a recent audit.

An effective incident response program is designed to detect cyber infiltrations and promote recovery, but auditors concluded that BBG, the State Department component that runs the Voice of America, did not achieve that goal.

In reviewing seven cybersecurity incidents that took place between October 2014 and May 2015, auditors determined that BBG did not comply with federal standards.

The board did not finalize its official incident response and reporting policy until May 7, 2015, but the report states that "even if the policies and procedures had been in place, the deficiencies would most likely have persisted." That's because the final policy did not comply with guidance from the U.S. Computer Emergency Readiness Team and the National Institute of Standards and Technology.

Furthermore, the policy lacked "essential processes...including risk assessment, host security, network security, malware prevention, and user awareness and training."

US-CERT requires agencies to report and designate a threat level (from zero to six) for all computer security incidents. Auditors concluded that "BBG did not assign category levels for any of the seven cybersecurity incidents tested."

Of those incidents, two unidentified breaches were not even reported to US-CERT, and a third was not reported in "a timely manner."

The report recommends that BBG amend its program to adhere to federal standards. BBG officials said they concurred with the recommendations.