Despite improvement, Thrift Board infosec needs work

The Federal Retirement Thrift Investment Board still has work to do to improve the information security of the systems that safeguard the retirement accounts of millions of armed services and federal workers.

In recent months, the Board has made efforts to firm up its security protocols for its Thrift Savings Plan participants. Retirees and employees hoping to access their spending accounts now have to implement two-factor authentication, a mandate that the Board implemented last December in an effort to cut down on phishing and fraud.

However, the fiscal year 2019 Federal Information Security Modernization Act review showed that FTRIB still had not "fully developed and implemented an effective, organization-wide information security program."

Patrick Bevill, the agency's chief information security office, presented the FISMA audit results at a Feb. 24 board meeting.

Security experts audited all eight of FRTIB's domains for Fiscal Year 2019 at both a systems-specific and agency-wide level. Seven of eight domains measured by the audit, such as risk-management, identity and access management, data protection and privacy, were graded with a maturity level of two or three out of five, indicating that policies are in place but are not consistently implemented.

FTRIB received a score of one in contingency planning, a category covering post-incident recovery. On the FISMA scale, a one indicates that the agency approach is "ad hoc".

Bevill said he's working on two recommendations from the report: to firm up and follow established policies and procedures that would secure and support FRTIB's operations, and to establish performance metrics and corrective actions processes.