Grassley Wants HHS Cyber Test Responses

Share

 

Senate Finance Committee chairman Charles Grassley (R-IA) is asking HHS secretary Alex Azar for information on the department’s efforts to implement recommendations from the HHS Inspector General (OIG) to improve cybersecurity in eight HHS agencies including FDA. In a 4/9 letter, Grassley says the OIG recommendations included use of standard security requirements, requiring contractors to comply with appropriate security standards, and improving continuous monitoring procedures. The recommendations were in an OIG 3/1 report outlining the results of penetration testing of the eight agencies.

 

“The tests probed and analyzed the cyber posture and vulnerability from outside of the HHS operating division’s network security perimeter,” the letter says. “…While the HCC Office of Information Security concurred with the recommendations, I would like clarification on what HHS has done to achieve these objectives.”

 

The letter specifically asks:

 

  •  which HHS departments were notified via early alerts about the OIG’s findings;
  • whether HHS has implemented any agency-wide cyber policies to address concerns raised in the OIG report, with information on what the policies are and when they were implemented;
  • a written summary on how HHS has implemented fixes sufficient to close the recommendations; and a timeline outlining implementation of the recommended policies and anticipated dates of compliance.

Read more