United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 2001-09-12 monographic deposited born digital GA 1.13:GAO-01-1067 https://www.govinfo.gov/app/details/GAOREPORTS-GAO-01-1067 P0b002ee18039a106 f:d011067 DGPO 2010-08-12 2011-03-24 GAOREPORTS-GAO-01-1067 machine generated eng fdlp REPORT GAOREPORTS-GAO-01-1067 GAO-01-1067 Computer security Financial management Information systems Information technology Internal controls Dept. of Education Central Automated Processing System Other Written Product A01697 The Department of Education places significant reliance on its Central Automated Processing System (EDCAPS) to support the department's core financial management information functions, including general ledger and funds management, grant planning and payment processing, and purchasing and contract management. Education's Inspector General (IG) has reported serious information system control weaknesses in this system. Such reported weaknesses in information system controls increased the risk of unauthorized access or disruption of services and made Education's sensitive grant and loan data vulnerable to inadvertent or deliberate misuse, fraudulent use, improper disclosure, or destruction, which could have occurred without being detected. Education is making progress in correcting security weaknesses identified by the IG and the department has taken other actions to improve security. However, GAO identified weaknesses that place critical financial and sensitive grant information at risk of unauthorized access and disclosure, and key operations at risk disruption. Specifically, Education did not sufficiently protect its network from unauthorized users, effectively manage user IDs and passwords, appropriately limit access to unauthorized users, effectively maintain system software controls, or routinely monitor user access activity. Further, Education was not providing adequate physical security for its computer resources, appropriately segregating all key operations and computer functions, effectively controlling changes to its applications, or fully addressing all aspects of its service continuity needs. Education has since corrected some of the weaknesses and developed a corrective action plan to address the remaining weaknesses. https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-01-1067/html/GAOREPORTS-GAO-01-1067.htm GAO-01-1067 https://www.govinfo.gov/app/details/GAOREPORTS-GAO-01-1067 Other Written Product GAO-01-1067; Education Information Security: Improvements Made But Control Weaknesses Remain; Computer security Financial management Information systems Information technology Internal controls Dept. of Education Central Automated Processing System