The Government Accountability Office has called on the Nuclear Regulatory Commission’s chief information officer, Scott Flanders, to address open recommendations related to cybersecurity and IT acquisitions.
In a letter addressed to Flanders, Nick Marinos, the congressional watchdog’s managing director for cybersecurity and IT, said it identified six open recommendations that fall under a pair of areas categorized as high risks: “ensuring the cybersecurity of the nation” and “improving IT acquisitions and management.”
According to GAO, implementing the open recommendations could improve NRC’s defense against threats and enhance its capability to manage critical systems, information and operations.
Recommendations to CIOs could also identify opportunities for critical systems, improve government IT and eliminate IT mismanagement.
GAO’s Open Recommendations to NRC
One recommendation involves NRC’s implementation of event logging requirements as directed by the Office of Management and Budget. The letter revealed that, although NRC has made progress with the cybersecurity measure, the agency still needs to fully implement the requirement based on OMB’s guidance.
GAO also recommended that the NRC CIO develop guidance for establishing cloud service level agreements, or SLAs, with vendors. The SLAs should include clear performance metrics, continuous awareness of asset confidentiality and integrity, and detailed descriptions of roles and responsibilities.
“In addition, we recommended that NRC complete annual reviews of its IT portfolio consistent with federal requirements,” Marinos wrote. “Until NRC implements this recommendation, investments with substantial cost, schedule, and performance problems may continue unabated without necessary corrective action.”
