The HHS OIG says the Administration for Children and Families stored data in an at-risk cloud system.
The Health and Human Services’ Office of Inspector General (HHS OIG) recently released a report showing that the Administration for Children and Families (ACF) may have placed data at risk in its cloud information system by failing to adequately safeguard its infrastructure and software.
The ACF is designed to support and offer initiatives that empower families and improve access to services that create strong, healthy communities. Projects include refugee resettlement, childcare, and more.
In late March, the OIG conducted an audit of the ACF and found that the ACF did not have an accurate inventory of all its cloud computing assets.
The audit determined some security controls were in place to protect cloud information systems, but were not implemented across the board in compliance with federal regulations. The report also found that the ACF did not conduct adequate testing to identify vulnerabilities proactively.
Ultimately, the OIG found that certain systems may be at a “high risk of compromise.”
The OIG conducted this audit to determine if the ACF aligned with HHS policies, federal requirements, and security controls determined by the National Institute of Standards and Technology (NIST).
ACF uses cloud services to process, store, and transmit ACF-related information. The OIG found that approximately 62% of ACF’s information systems were hosted by cloud service providers.
Their findings indicated that security control of access enforcement and information input validation were both at critical levels of vulnerability. Many other security components were at a high or medium level of vulnerability.
Following the findings, the OIG made the following recommendations for the ACF:
ACF responded to the OIG, generally agreeing with recommendations and describing steps the administration had already taken to reduce vulnerabilities in its cloud infrastructure.
Audits like this help determine where an organization stands regarding security requirements. To conduct the audit, the OIG tested and probed various components of ACF’s cloud infrastructure and software.
While an audit is highly beneficial, organizations should consider conducting these tests themselves regularly to ensure compliance with the NIST, federal regulations, and any other requirements.
In the past, government bodies have received criticism for failing to meet their own federal regulations. Audits are a step in the right direction to improve accountability and promote public awareness.
While the recommendations for the ACF will take time to implement, it’s necessary that the public, and the organizations themselves, are aware of the importance of maintaining data security and compliance.
Read more: HIPAA Compliant Email: The Definitive Guide