- A fiscal 2025 audit has found that the VA is still struggling to meet FISMA cybersecurity requirements
- The review has identified persistent weaknesses in access controls, configuration management, security management and service continuity
- Auditors have cited deficiencies involving patch management, system upgrades, configurations and security monitoring
The Department of Veterans Affairs continues to face challenges meeting Federal Information Security Modernization Act, or FISMA, requirements, according to a fiscal 2025 audit conducted by the VA Office of Inspector General.
In a report released Monday, the OIG said it contracted CliftonLarsonAllen to evaluate VA’s information security program and assess compliance with FISMA requirements.
What Did the FY 2025 FISMA Audit Evaluate?
The audit reviewed 24 applications and general support systems hosted at 11 VA facilities and on the VA Enterprise Cloud. Access controls, configuration management controls, security management controls and service continuity practices all showed persistent shortcomings, according to the assessment. These weaknesses affect safeguards that are intended to prevent unauthorized access, alteration or destruction of mission-critical systems.
The audit also identified areas where VA could address deficiencies, including security patch deployment, system upgrades, system configurations, performance monitoring and communication of security issues to appropriate personnel.
Cybersecurity, data protection and IT modernization remain critical priorities for federal health agencies as they work to secure mission systems and patient information. Learn how government leaders are addressing these challenges at the Potomac Officers Club’s 2026 Healthcare Summit on Dec. 3. Sign up now.
What Recommendations Did the Audit Provide?
The audit resulted in 19 recommendations, including two new ones. A number of the outstanding recommendations were traced back to repeat deficiencies flagged in earlier FISMA reports. VA did not concur with the recommendations.
Six prior recommendations were closed after CliftonLarsonAllen found the related issues had been resolved. The firm said it plans to monitor the unresolved recommendations and gauge whether corrective actions taken are adequate as part of its fiscal 2026 audit of VA’s information security program.
FISMA requires agencies, chief information officers and inspectors general to conduct this kind of annual evaluation of federal information security programs and submit compliance findings to the Department of Homeland Security and Congress.
