Summary of Internal Control Issues Over the Peace Corps' Financial Reporting FY 2019

That the OCIO fully implement an ISCM strategy that includes policies and procedures, defined roles and responsibilities, and security metrics to measure effectiveness.

That the Peace Corps Director and Agency Risk Executive, in coordination with the Peace Corps senior leadership, identify the agency’s information security risk profile and define the agency’s risk appetite and risk tolerance.

That the Agency Risk Executive, in coordination with the Peace Corps senior leadership, develop and implement an enterprise-wide risk management strategy to address how to identify, assess, respond to, and monitor security-related risks in a holistic approach across the organization, business process, and information system levels.

That the OCIO perform all components of the Security Assessment and Authorization on all FISMA-reportable systems in accordance with the risk management strategy.

That the OCIO develop an information security architecture that is integrated with the risk management strategy.