Federal Information Security Modernization Act of 2014 Audit of the U.S. Department of Education’s Information Security Program and Practices - Final Audit Report - 2025

Oct 15, 2026

Final Audit Report covering the Federal Information Security Modernization Act of 2014 for the U.S. Department of Education’s information security program and practices for Fiscal Year 2025. The Office of Inspector General contracted with the independent certified public accounting firm Williams, Adley & Company – DC, LLC to assess security controls in the period July 1, 2024 through June 30, 2025. The audit was performed under generally accepted government auditing standards, with OIG oversight through plan review, monitoring, status meetings, and draft/final report reviews, and includes responsibility for corrective action planning and tracking through department systems.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages68

Reading Time2 h 51 min

AccessFree to download

Final Audit Report

Purpose, scope, and audit standards

OIG oversight and contractor responsibilities

Findings, corrective actions, and reporting requirements

Distribution and related administrative notes

U.S. Department of Education Office of Inspector General The U.S. Department of Education’s Federal Information Security Modernization Act of 2014 Report For Fiscal Year 2025 July 31, 2025 ED-OIG/A25IT0212 July 31, 2025 TO: Thomas N. Flagg Chief Information Officer Office of the Chief Information Officer FROM: Keith Cummins /s/ Acting Deputy Assistant Inspector General Audit Services Office of Inspector General SUBJECT: Final Audit Report Federal Information Security Modernization Act of 2014 Audit of the U.S. Department of Education’s Information Security Program and Practices for Fiscal Year 2025 Control Number ED-OIG/A25IT0212 Attached is the final audit report that determined whether the U.S. Department of Education’s (Department) overall information technology security programs and practices are effective as they relate to Federal information security requirements. We contracted with the independent certified public accounting firm of Williams, Adley & Company – DC, LLC (Williams Adley) to conduct this audit. The audit assessed the information and information system security controls in place during the period of July 1, 2024, to June 30, 2025. The contract required that the audit be performed in accordance with generally accepted government auditing standards (GAGAS) . In connection with the contract, the Office of Inspector General (OIG) reviewed, provided feedback, and ultimately approved the audit plan. In addition, OIG monitored the performance of the audit, reviewed contractor audit documentation, attended critical meetings with the Department officials and reviewed the contractor’s audit controls. As part of the oversight and monitoring, the OIG: • ensured the audit complied with GAGAS and other OIG policies and procedures; • ensured contract requirements regarding objectives, scope, and methodology were being met; • held bi-weekly status meetings to discuss whether milestones were being met; and • performed draft and final report reviews, conducted within the Information Technology Oversight Team, to provide assurance that the contractor’s work can be relied upon. An electronic copy has been provided to your Audit Liaison Officer. Williams Adley received and evaluated the Office of the Chief Information Officer (OCIO) management comments in response to the findings and recommendations in the report. OCIO agreed to provide corrective action plans for all recommendations by September 30, 2025. Corrective actions proposed (resolution phase) and implemented (closure phase) by your office will be monitored and tracked through the Department’s Audit Accountability and Resolution Tracking System. The corrective action plan should set forth the specific action items and targeted completion dates necessary to implement final corrective actions on the findings and recommendations contained in this final report. In accordance with the Inspector General Act of 1978, as restated (5 U.S.C. §§ 401–424), the Office of Inspector General is required to report to Congress twice a year on recommendations that have not been completed after 6 months from the date of issuance. In accordance with the Freedom of Information Act (5 U.S.C. § 552), reports issued by the Office of Inspector General are available to members of the press and general public to the extent information contained therein is not subject to exemptions in the Act. Williams Adley is responsible for the enclosed auditor’s report and the conclusions expressed therein. The OIG’s review disclosed no instances where Williams Adley did not comply, in all material aspects, with GAGAS. We appreciate the cooperation shown to Williams Adley and the OIG during this audit. If you have any questions, please contact Joseph Maranto, Director, Information Technology Oversight Team at 202- [245-7044 or](245-7044 or joseph.maranto@ed.gov)[ ](245-7044 or joseph.maranto@ed.gov)[joseph.maranto@ed.gov](245-7044 or joseph.maranto@ed.go

FAQs

What is the purpose of this final audit report?

It determines whether the U.S. Department of Education’s overall IT security programs and practices are effective as they relate to federal information security requirements.

Who conducted the audit and how was it overseen?

Williams, Adley & Company – DC, LLC conducted the audit, while the Office of Inspector General reviewed, provided feedback, approved the audit plan, monitored performance, and reviewed draft and final report work.

What period did the audit cover for Fiscal Year 2025?

The audit assessed information and information system security controls in place from July 1, 2024 to June 30, 2025.

Oct 15, 2026

Uploaded by วิน