Finding 2024-003
Bridges Security Management and Access Controls
Management Views
MDHHS agrees with the finding.
Planned Corrective Action
For parts a., b., c., and d., MDHHS implemented the Database Security Application (DSA) on October 2, 2023, which includes documenting incompatible role except...
Finding 2024-003
Bridges Security Management and Access Controls
Management Views
MDHHS agrees with the finding.
Planned Corrective Action
For parts a., b., c., and d., MDHHS implemented the Database Security Application (DSA) on October 2, 2023, which includes documenting incompatible role exception requests and user access request approvals, semi-annual review of privileged users, and annual review for all users. Security management and access control processes will continue to be a standing agenda item for ongoing quarterly training sessions with Local Office Security Coordinators (LOSCs).
For parts a., c., and d., the Access Management Section began conducting quarterly reconciliations of DSA to the Bridges Integrated Automated Eligibility Determination System (Bridges) during the first quarter of fiscal year 2025.
For part b., MDHHS is currently evaluating the feasibility of establishing a quarterly review process to help ensure documentation is maintained for a sample of LOSC monitoring reports. MDHHS anticipates completing the evaluation by September 30, 2025, and will determine an anticipated completion date for implementation, if necessary, at that time.
For part e., MDHHS Local Office Directors, District Managers, or designees review a monthly sample of high-risk Bridges transactions to ensure documentation was properly maintained. Beginning September 2024, MDHHS Business Service Centers (BSC) implemented a monitoring process to ensure monthly reviews are completed by the local offices timely and that the documentation is properly maintained.
Anticipated Completion Date
a., c., d., and e. Completed
b. September 30, 2025
Responsible Individual(s)
a., b., c., and d. Jim Bowen, MDHHS
e. Veronica Maxson, MDHHS