The Peace Corps Office of Inspector General (OIG) found that the agency’s information security program remained ineffective in fiscal year (FY) 2026, with weaknesses in nine of 10 domains reviewed under the Federal Information Security Modernization Act (FISMA).
The Nov. 10 management challenges report said the program remained at Level 2 overall. Level 4 signifies an effective information security program, according to the Office of Management and Budget.
“OIG’s review of the Peace Corps’ information technology (IT) security management indicates that additional efforts are needed to strengthen IT controls across multiple areas, address IT vulnerabilities and cybersecurity breach response issues, and substantially improve the agency’s information security program,” the report states.
The report also notes that agency networks contain sensitive medical and personal information for staff and volunteers, as well as mission-critical data. The Peace Corps’ global operations support 3,400 volunteers and trainees across 56 posts and 60 countries, under a $410.5 million annual budget, OIG said.
The watchdog said six recommendations from prior years remained open, and it issued eight new recommendations addressing FY2026 deficiencies.
Peace Corps reaches Level 4 for the first time in one FISMA domain
The Peace Corps reached Level 4 for the first time in one of the 10 domains – Security Training. In addition, it closed the final open recommendation from a FY2024 review of three security incidents after demonstrating that configured tools met operational needs and provided adequate logging and monitoring, according to the OIG.
The agency also closed two prior FISMA recommendations concerning supply-chain risk policies and formal cybersecurity profile processes.
Following penetration testing in FY2025, which identified risks ranging from informational to critical-severe, the Peace Corps closed four of the resulting seven recommendations, while three recommendations tied to phishing campaign risks and threats remained open.
The OIG said the Peace Corps needs to address the FY2026 and earlier recommendations to advance toward a Level 3 maturity level for its information security program.