Finding 2022-008 MiSACWIS Security Management and Access Controls Management Views MDHHS agrees with parts a., b., d., and e. of the finding. DTMB disagrees with part c. of the finding. For part c., although MDHHS and DTMB had not fully documented all database specific configuration standards unti...
Finding 2022-008 MiSACWIS Security Management and Access Controls Management Views MDHHS agrees with parts a., b., d., and e. of the finding. DTMB disagrees with part c. of the finding. For part c., although MDHHS and DTMB had not fully documented all database specific configuration standards until after the audit period, DTMB disagrees that during the audit period the system contained potentially vulnerable database configurations and disagrees that DTMB cannot ensure the security of the data. DTMB has been and continues to implement the manufacturer?s recommendations regarding security configurations. In addition, the databases reside in restricted trusted internal security zones, protected by firewalls, which are specific to each application and database, in conjunction with intrusion protection, antivirus software, and SOM standard security safeguards. Planned Corrective Action For parts a. and e., MDHHS will continue to provide training for LOSCs via quarterly webinars to emphasize the proper procedures for granting access and how to review and compare access to DSA approved requests. For part b., MDHHS will add an Incompatible Role form into the DSA Michigan Statewide Automated Child Welfare Information System (MiSACWIS) request with automated routing for appropriate approval. This would ensure that documentation was maintained, and appropriate approvals secured in all situations. For part c., DTMB developed an organization-wide framework for database security configuration management. For part d., MDHHS has implemented a quarterly report in MiSACWIS that will identify any financial authorization that was approved by the same person that created the authorization. Anticipated Completion Date a. and e. Corrective action is ongoing. b. MDHHS has not yet determined an anticipated completion date because implementation is dependent on funding, approval, and prioritization of proposed system changes. c. DTMB anticipates having compliance documentation by September 30, 2023. d. MDHHS will receive the first quarterly report on September 30, 2023, and will perform a review of the transactions identified on that report during October 2023. Responsible Individual(s) a., b., and e. Alana Lowe and Deon Nelson, MDHHS c. Heather Frick and Nathan Buckwalter, DTMB d. Alana Lowe, MDHHS