The Department of Veterans Affairs (VA) essentially failed its latest Federal Information Security Modernization Act (FISMA) audit, with continuing information security deficiencies that could leave mission-critical systems vulnerable to intrusion, according to a watchdog report.
But the VA is challenging the July 27 report from the department’s Office of Inspector General (OIG), arguing that auditors did “not fully reflect the current state” of VA’s cybersecurity program, which is making substantial progress.
The fiscal year 2025 audit – conducted under the 2014 FISMA law that requires federal civilian agencies to comply with cybersecurity standards – found that VA “continues to face significant challenges meeting FISMA requirements because of the nature and maturity of its information security program.”
The audit report identified deficiencies in areas “designed to protect mission-critical systems from unauthorized access, alteration, or destruction.” They include security management; background investigations; contingency planning; identity management and access controls; configuration management; incident response and monitoring, and vulnerability management.
Despite some improvements, the auditors wrote, “we continue to see information system security deficiencies similar in type and risk level to our findings in prior years and an overall inconsistent implementation and enforcement of the security program.”
The audit was conducted under contract with the VA OIG by accounting firm CliftonLarsonAllen, which has been wrestling with the VA over its FISMA compliance for years.
As far back as 2019, a CliftonLarsonAllen’s FISMA audit of the VA noted continuing information security deficiencies and “an overall inconsistent implementation of the security program.”
In the 2025 report, auditors made 19 recommendations, some covering repeated deficiencies from previous FISMA reports, while closing six previous recommendations due to improvements.
The recommendations suggested that VA improve “the deployment of security patches, system upgrades, and system configurations,” along with performance monitoring “to ensure controls operate as intended” and that identified security deficiencies are better communicated internally.
In VA’s response, signed by Deputy Secretary Paul Lawrence, the agency said it did not concur with the 19 recommendations for improvement “because many of the findings did not fully account for the security controls, monitoring, and processes already in place across the Department.”
“The audit captured a snapshot in time …VA believes many of the recommended actions are already underway, already implemented, or do not fully reflect the current state of VA’s cybersecurity program,” the VA said.
The response said VA made “significant progress” in its cybersecurity posture in fiscal year 2025 and “remains focused on continuing to strengthen cybersecurity and reducing risk to Veteran services and data.”
Among the specific information security deficiencies identified in the OIG report:
- Vulnerability management. Auditors found “security control deficiencies related to unsecure web application servers, excessive permissions on database platforms, vulnerable and unsupported third-party applications and operating system software, and a lack of common platform security standards and monitoring across the enterprise.”
- “Without effectively monitoring device configurations, software, and applications installed on its networks,” they wrote, “VA is at risk that malicious users may introduce potentially dangerous software or malware into the VA computing environment.”
- Contingency planning. While VA contingency plans “provide high-level recovery objectives for systems and operations in the event of disruption or disaster,” the auditors noted that “contingency plans did not always include all required information and were inconsistently documented and tested.”
- “We identified several instances of system disruptions and outages related to the VA network and several key applications that were not resolved within documented recovery time objectives,” the auditors wrote.
- Application and system software vulnerabilities. Network vulnerability assessments conducted by the auditors “identified a number of outdated operating systems and vulnerable third-party applications that could allow unauthorized access onto mission-critical systems and data.”
- “Many of VA’s legacy systems have been obsolete for several years,” the audit said. “Due to their age, legacy systems are more costly to maintain and difficult to update to meet existing information security requirements. Furthermore, deficiencies in VA’s patch and vulnerability management program could allow malicious users to gain unauthorized access into mission-critical systems and data.”