Finding 2025-004 Bridges Security Management and Access Controls Management Views MDHHS agrees with the finding. Planned Corrective Action For parts a., b., c., and d., MDHHS implemented the Database Security Application (DSA) on October 2, 2023, which includes documenting incompatible role exceptio...
Finding 2025-004 Bridges Security Management and Access Controls Management Views MDHHS agrees with the finding. Planned Corrective Action For parts a., b., c., and d., MDHHS implemented the Database Security Application (DSA) on October 2, 2023, which includes documenting incompatible role exception requests and user access request approvals, semi-annual review of privileged users, and annual review for all users. Security management and access control processes will continue to be a standing agenda item for ongoing quarterly training sessions with local office security coordinators (LOSC). For parts a., c., and d., the Access Management Section began implementing a process to conduct quarterly reconciliations of the DSA to the Bridges Integrated Automated Eligibility Determination System (Bridges) during March 2025. Due to the complexity of the reconciliations and time constraints, MDHHS requested the Bridges technical team to develop a consolidated Excel based report to add a level of automation to the process. The report is now available on an ad hoc basis, and the Access Management Section began utilizing it during April 2026 to conduct reviews and provide remediation with the LOSCs and end users. Full automation of the report remains in progress due to significant competing priorities and limited resources. For part b., MDHHS implemented the automated DSA periodic access review process (PAR) during January 2026 to review all users every 90 days, instead of the current 180 days for privileged users. MDHHS updated its policy to require initiation of the PAR in the DSA for all users every 90 days, without exception, to comply with State standards. For part e., MDHHS local office directors, district managers, or designees review a monthly sample of high-risk Bridges transactions to ensure documentation was properly maintained. Beginning September 2024, MDHHS Business Service Centers (BSC) implemented a monitoring process to ensure monthly reviews are completed by the local offices timely and that the documentation is properly maintained. To strengthen compliance, MDHHS will reinforce expectations through manager training and emphasize the requirement to maintain complete records and to sign and date all review reports within 30 days of the report run date. Additional training sessions will be repeated as needed to ensure consistent adherence to documentation and timeliness standards across all local offices. Anticipated Completion Date a., c., and d. Ongoing b. Completed e. September 30, 2026 Responsible Individual(s) a., b., c., and d. Tim Kwast, MDHHS e. Tim Kwast and Veronica Maxson, MDHHS