Comments on Draft Report on Audit of Overseas Laptop

UNCLAS BOGOTA 003702 SIPDIS FOR OFFICE OF INSPECTOR GENERAL (OIG) E.O. 12958: N/A TAGS: AMGT ASIG AINF SUBJECT: Comments on Draft Report on Audit of Overseas Laptop Computer Inventory Controls and Security Management (AUD/SI-10-08) REF: A) 6 NOV 2009 MEMORANDUM FROM OIG HAROLD W. GEISEL TO AMBASSADOR, U.S. EMBASSY BOGOTA B) DRAFT REPORT ON AUDIT OF OVERSEAS LAPTOP COMPUTER INVENTORY CONTROLS AND SECURITY MANAGEMENT (AUD/SI-10-08) ¶1. Following is Embassy Bogota comments on the draft report and information on actions taken for the seven recommendations (Nos. 2, 4, 7, 9, 11, 13 and 15) that require Post's attention per Ref A. ¶2. OIG Recommendation 2. OIG recommends that Embassies Bogota, Mexico City, Rome, and Vienna require the Information Management Officer and the General Services Officer to ensure that all laptops are properly entered into the post inventory system and periodically reconciled to manual records. Agree. Per the draft OIG report, ref B, IMO and GSO will ensure that NAS procured laptops and RSO procured laptops are entered in ILMS even when the laptops are procured outside of normal Embassy procurement channels. IMO & GSO will ensure that all NAS and RSO personnel understand Post's policies. IMO has taken over the management of NAS laptop inventory to ensure all NAS laptops are properly inventoried. ¶3. OIG Recommendation 4. OIG recommends that Embassies Bogota and Mexico City require the Information Management Officer to submit the results of the next physical inventory of laptop computers, along with the accompanying reconciliation of the official inventory with the Information Management Officer's unofficial inventory, to the Bureau of Information Resource Management and the Office of Inspector General. Agree. GSO and IRM will match laptop inventories on a quarterly basis and ensure all laptops, however or by whoever procured are entered into the ILMS inventory. IMO is now responsible for complete management of all State Department laptops. ¶4. OIG Recommendation 7. OIG recommends that Embassies Bogota, Mexico City, Rome, and Vienna require the Information Management Officer to ensure compliance with laptop loan out procedures and the proper preparation of supporting documentation. Agree. IMO will assure that per the OIG draft report, ref B, since "Most of the documents were in the NAS, where officials said that they were not aware of the requirement to have authorizing 
Signatures." NAS officials are aware of the requirement. Ref B also states that "OIG informed the NAS chief that all laptop loans required a supervisory authorizing official to sign the forms, and he agreed to ensure that this was done in the future." IMO is now responsible for all NAS laptops and will ensure these laptops adhere to all Post and Department procedures. ¶5. OIG Recommendation 9. OIG recommends that Embassy Bogota require the Information Management Officer and the General Services Officer to investigate the disposition of each missing laptop and prepare the required documentation as necessary. The Bureau of Information Resource Management and the Office of the Inspector General should then be notified with the accompanying documentation. Agree. Per Ref B "this occurred because the Embassy's NAS and GSO did not follow required Department procedures for reporting missing laptop...NAS should have reported these losses immediately to the IMO." This recommendation also relates back to recommendation 2 where "all laptops are properly entered into the post inventory system". Once this occurs IMO can ensure all laptops are counted and missing laptops properly disposed of. Per Ref B, "During its visit, OIG informed NAS and the GSO of the need to immediately report the missing laptops to cognizant officials for appropriate actions...In March 2009, the NAS prepared the required property disposal reports for its five laptops." IMO will remind NAS and GSO of the reporting requirement for missing property as directed in FAM. IMO is now responsible for all laptops so this issue should never recur. ¶6. OIG Recommendation 11. OIG recommends that Embassies Bogota, Mexico City, Rome, Tokyo, and Vienna and the American Institute in Taiwan require the Information Management Officer to ensure that all laptop users receive the annual cyber security awareness briefing and to maintain documentation to support that the briefing was presented. Agree. IMO is now managing the complete laptop program. Since all laptop users will be subject to procedures outlined in Ref B there should be no unsigned acknowledgement forms. By signing the form DS-7642 Mobil Computing and Data Storage Request, the user acknowledges that the briefing has been completed. ¶7. OIG Recommendation 13. OIG recommends that Embassy Bogota and the American Institute in Taiwan require the Information Management Officer to comply with the provisions of the Foreign Affairs Handbook (12 FAH-6 H-542.5-10) for hard drive disposition and the proper preparation of laptop shipping documentation. Agree. Per Ref B, "During FY 2008, Embassy Bogota's NAS disposed of 14 laptops through auction, but the NAS did not follow the Department's regulation for the proper disposition of hard drives. The FAH (12 FAH-6 H-542.5-10) requires all hard drives to be sent via classified pouch to IRM for disposition. NAS officials said that the hard drives had been erased with Department-approved software to remove any information prior to sale. However, all hard drives must be sent via classified pouch to IRM for disposition. The NAS officials further stated that they were unaware of the requirement to send the hard drives to IRM and that it was the NAS's understanding that embassies and posts were allowed to sanitize hard drives and to destroy them in accordance with local procedures." IMO is now managing the laptop program including all NAS laptops. Disposition of all NAS laptops and hard drives will comply with the provisions of 12 FAH-6 H-542.5-10. ¶8. OIG Recommendation 15. OIG recommends that Embassies Bogota, Mexico City and Vienna require the Information Management Officer to comply with Department of State policy to encrypt all laptops or to obtain waivers when there is a valid operational justification. Agree. IMO is now managing the laptop program and all laptops are encrypted. NAS and RSO laptops that were too old for encryption have been disposed. ¶9. Post appreciates the opportunity to participate in this overseas review and correct noted deficiencies. BROWNFIELD