VA fails watchdog FISMA audit on IT security, but agency disagrees

The Department of Veterans Affairs is still failing its Federal Information Security Modernization Act audits, the department’s Office of the Inspector General reported Monday, though the VA said the review’s findings are lacking.

Specifically, the independent audit by CliftonLarsonAllen LLP (CLA) found that in fiscal 2025, the VA was deficient in vulnerability management, incident response and monitoring, configuration management, identity management and access controls, contingency planning, background investigations and its agency-wide security management program.

“VA continues to face significant challenges in complying with FISMA due to the nature and maturity of its information security program,” CLA said in the report.

While the agency has made progress and closed several recommendations from previous FISMA audits, CLA said the VA is still not in compliance with the law that regulates federal agency information security. 

Of the list of grievances, CLA said the VA failed to consistently disable accounts of former account holders, performed insufficient background checks on some “higher risk positions,” had several outdated operating systems and application vulnerabilities, and did not resolve system outages within recovery time objectives.

The VA, however, did not concur with the report’s findings nor its 19 recommendations, saying “many of the findings did not fully account for the security controls, monitoring, and processes already in place across the Department.”

“The audit captured a snapshot in time, while VA manages cybersecurity continuously through ongoing monitoring, automated tools, and risk-based decision making,” the VA said in the department’s response. “Non-concurrence does not mean VA disagrees that improvements should continue. It means VA believes many of the recommended actions are already underway, already implemented, or do not fully reflect the current state of VA’s cybersecurity program.”

The VA highlighted that in fiscal 2025, the VA completed its Cybersecurity Supply Chain Risk Management Strategy, deployed automated log analysis tools for anomaly detection and reduced plans of action and milestones over a year old by 93%.

It also laid out its goals for fiscal 2026 through 2029, which include enrolling 100% of enterprise identities into an Identity Governance Administration solution, protecting 50% of medical devices with next-generation firewall-based zone isolation and remediating 100% priority one vulnerabilities within two weeks.

Last week, the Government Accountability Office said some of the VA’s software management issues are due in part to its chief information officer vacancy. 

Though the nominee, Gary Shatswell, has not yet been put on the Senate’s schedule, Keith Rhodes, the Department of Agriculture’s enterprise network services deputy director, started as the VA’s deputy CIO this month, according to his LinkedIn.