Description:

DPAS does not currently have the ability to internally track the annual user audit conducted each year by the Information Owners (IOs) and their Alternates (AIOs).

 

Recommended:

Provide ability within DPAS for IOs/AIOs to complete their Annual user audit that meets all SSAE requirements. Allow for a way to track that their Org has run their necessary user listings (SCR 01731 in process for user listing functionality across all modules) but also provide them a checklist they can complete and certify that includes verifying: users completion of DoD CA training, user roles and tier access is correct or has been updated accordingly, any personnel removals have been completed, all inactive or terminated accounts have processed correctly, and all risk for incompatible duties within DPAS operations have been mitigated. Internal DPAS Security Officers will need the ability to run a report that shows status of the Annual User Audit to assist us with whom has and has not completed the audit so that we can reach out to assist and well as know which groups may need accounts put into suspense if there is no completion.

 

Mission Critical:

Yes, this is mission critical to assist with the annual requirement to monitor, review and audit users and their access. This supports our SSAE audit readiness.

 

Benefits:

Reduce time spent on manual tracking of Annual user audit. Improve the accountability and tracking of the audit process and supports the SSAE.

 

Users:

All users are affected by the Annual user audit.